ML20138B044

Forwards Missing Sections of 850826 Draft SER Re Current Status of NRC Review of FSAR

ML20138B044
Person / Time
Site:	South Texas
Issue date:	10/04/1985
From:	Novak T Office of Nuclear Reactor Regulation
To:	Goldberg J HOUSTON LIGHTING & POWER CO.
References
NUDOCS 8510110274
Download: ML20138B044 (137)

Text

e O

N OCT 4 1985 Docket Nos.:

50-498 DISTRIBUTION and 50-499 Docket File 50-498/499 PRC System NRC PDR LPDR EJordan Mr. J. H. Goldberg NSIC ACRS (16)

Group Vice President - Nuclear LB#3 Rdg Houston Lighting and Power Company JLee Post Office Box 1700 NPKadambi Houston, Texas 77001 Attorney, OELD JPartlow Cear Mr. Goldberg:

BGrimes

Subject:

Draft Safety Evaluation Sections for the South Texas Project, Units 1 and 2 The NRC staff issued a Draft Safety Evaluation Report (DSER) on August 26, 1985 reflecting the current status of the staff review.

It was indicated that the DSER was not a complete document.

In an effort to complete some of the missing sections of the DSER, enclosed are sections documenting the evaluation by the staff of the indicated portions of the FSAR. The documentation could change as the review progresses; however, in its current form the evaluations should serve as the basis for discussions to resolve the remaining technical issues.

Please contact the Project Manager, N. Prasad Kadambi at (301) 492-7272 if you have any questions.

Sincerely, MlillNht, ylGl4LD 0y Thomas M. Novak, Assistant Director for Licensing Division of Licensing

Enclosure:

As stated cc:

See next page flPK DL:LB83

B#3 L - /L NPKadambi/yt SWKnighton T,ovak 10/l /85 10/g/85 10/ /85 0510110274 051004 PDR ADOCK 050 0

~

~

Mr. J. H. Goldberg Houston Lighting and Power Company South Texas Project cc:

William S. Jordan, III, Esq.

Brian Berwick, Eso.

Harman, Weiss & Jordan Assistant Attorney General 2001 S Street, NW Environmental Protection Division Suite 430 P. O. Box 12548 Washington, D.C.

20009 Capitol Station Austin, Texas 78711 Me. J. T. Westermeir Manager, South Texas Project Resident Inspector / South Texas Houston Lighting and Power Company Project P. O. Box 1700 c/o U.S. Nuclear Regulatory Commission Houston, Texas 77001 P. O. Box 910 Bay City, Texas 77414 Mr. H. L. Peterson Mr. G. Pokorny Mr. Jonathan Davis City of Austin Assistant City Attorney P. O. Rox 1088 City of Austin Austin, Texas 78767 P. O. Box 1088 Austin, Texas 78767 Mr. J. B. Poston Mr. A. Von Rosenberg Ms. Pat Coy City Public Service Boad Citizens Concerned About Nuclear P. O. Box 1771 Power San Antonio, Texas 78296 5106 Casa Oro San Antonio, Texas 78233 Jack R. Newman, Esq.

Ne man & Holtzincer, P.C.

Mr. Mark R. Wisenberg 1615 L Street, NW Manager, Nuclear Licensing Washington 0.C.

20036 Houston Lighting and Power Company P. O. Box 1700 Melbert Schwartz, Jr., Esq.

Houston, Texas 77001 Baker & Botts One Shell Plaza Mr. Charles Halligan Hcusten, Texas 77002 Mr. Burton L. Lex Bechtel Corporation Mrs. Peggy Buchorn P. O. Box 2166 Executive Director Houston, Texas 77001 Citizens for Ecuttable Utilities, Inc.

Route 1, Box 1684 Mr. E. R. Brooks Brazeria, Texas 77422 Mr. R. L. Range Central Power and Licht Company P. O. Box 2122 Corpus Christi, Texas 78403 U

I l

1 l

Houston Lighting & Power Company South Texas Project i

l l

cc:

Regional Administrator, Region IV U.S. Nuclear Regulatory Connission Office of Executive Director for Operations 611 Ryan Plaza Drive, Suite 1000 t

Arlington, Texas 76011 Mr. Lanny Sinkin Citizens Concerned About Nuclear Power 3022 Porter Street, NW #304 Washington, D.C.

20008 i

Mr. S. Head, Representative Houston Lighting and Power Company Suite 1309 7910 Woodmont Avenue l

Bethesda, Marylard 20814 t

l I

t 1

i I

l 1

2.4 Hydrologic Engineering i.

The staff has reviewed the hydrologic engineering aspects of the applicant's

{

design, design criteria, and design bases for safety-related facilities at i

South Texas. The acceptance criteria used as a basis for staff evaluations f

n Se i 2.

I t roug

-4 h

a cep a e c eri lu t

I applicable General Design Criteria (GDC) (10 CFR 50 Appendix A) Reactor Site Criteria (10 CFR 100), and Standards for Protection against radiation (10 CFR 20 Appendix B. Table II). Guidelines for implementation of the requirements 3

of the acceptance criteria are provided in RGs, ANSI standards, and Branch Technical Positions (BTPs) identified in SRP 2.4-1 through 2.4-14.

1 Conferrrance to the acceptance criteria provides the bases for concluding that the site and facilities meet the requirement of 10 CFR 20, 50, and 100 with respect to hydrologic engineering. All factual information in Section 2.4 of this SER has been obtained from the FSAR and ER for South Texas (Houston Power j

and Light Ccmpany,1978) unless the information is otherwise referenced.

i 2.4.1 Hydrologic Description I

i 2.4.1.1 Surface Water I

The South Texa's Project (STP) is located in south-central Texas about 12 mi

[

south-southwest of Bay City. As shown in Figure 2.1, the plant site is about 3 mi west of the Colorado River. The elevation of the Colorado River adjacent l

to the plant is about 2 ft above ecan sea level (msl).

By comparison, plant

{

grade elevation is 28 ft ms1. Except for knockout panels in the diesel i

buildings and the mechanical and electrical buildings, access to safety l

i i

l 1

l l

SB O

f O

l N

/

\\

IVEM *

/

gE W

, sj^r

/~ s s'

~~-

p l

' % g$YTM ggggg SASW..

%.s % m s

~ '= /

f,

/

~~~

/

r J

f-

/

b 5

)

'V

/

3 9

s

\\

I COL 001AOO yyER BAS N I

i g

\\

f,'

~ ~ ~ -- 1 l

~

s~m

\\.

N k

5

/'

s Ar

/ ggts pALACgS gASM K

~

s

, r _g

&g-x_

s I

\\

. i %unen.%

b amessetme l

}%

4 l

1 e6 u-o 4

~,

t.

s I

t l

\\

\\%~~ s h

)

b i

f s

's_______

-~s_,N

,, \\

gs I

s 1

+

-4

.g

+g l [

%g %,s,,

'\\

3 4

s

.f

_ sett e e m LMES 1\\

[

n_.x+- -

N x=

l Figure 2.1 RIVER BASIllS AND WATER BODIES VICI!i!TY OF SOUTH TEXAS PLANT Source: FSAR Figure 2.4.3-30

related facilities will be at or above 28 ft ms1. All safety related facilities subject to the design basis floods as discussed in section 2.4.4 are protected by waterproof knockout panels or doors.

As shown in Figure 2.2, the Colorado River heads in southeastern New Mexico from where it meanders in a southeasterly direction for about 890 mi to its mcuth in the Gulf of Mexico. The Colorado River basin is ccmprised of about 40,800 sq mi. However, because of the nature of the upper portion of the basin, as discussed below, only about 28,800 sq mi contribute to runoff in the Colorado River in the vicinity of the STP site. The STP is located cpposite River Mile 16.4.

The Colorado River flows through three hydrologically distinct areas: the High Plains Region, the Central Basin Region and the Coastal Plains Region.

These regions are separated by the Cap Rock Escarpment and the Balcones Fault Escarpment as shown in Figure 2.2.

The High Plains Region of the Colorado River basin does not contribute to runoff at the site because it is a flat semi-arid area where surface runoff is collected in numerous depressions where it is dissipated through percola-tion and evaporation. The topography of this region varies uniformly from an elevation of 4500 ft ms1 at the headwaters to about 2600 ft asl near the Cap Rcck Escarpment.

The Central Basin Region varies in topography frem smooth nearly flat areas to rolling plains and areas that have been deeply eroded into rough hills, buttes, mesas a,nd deep canyons. This region contains all of the principal tributaries to the Colorado River.

Below the Balcones Fault Escarpment, lies the Coastal Plains Region. This region is characterized by moderately rolling terrain having elevattens ranging frcm about 750 ft msl near the Balcones Fault Escarpment to about 300 ft ms1 near Columbus. At Columbus, the river enters the flat coastal prairie extending to the Gulf of Mexico.

e

-. k k

• WErer y-p

. s t

ans,,

.g c

l I

}'

'N -J

.Tg 7'

$ %, y e

.,C'~

_~

v ~;r n nfr eschQr,y, f

/

W.g *m gc,,,

f1

'*<rre

,~

y 3 g

~.

w:p

(

• tke43, g %e % 04stgdd*5

~

er 3,r, s

r*

Figure 2.2 COLORADO RIVER BASIN RESERVOIRS AND llYDR0 LOGIC REGIONS Source:

FSAR Figure 2.4-2

I t

The Colorado River upstream of the STP is regulated by 22 floodwater retaining structures as shown on Figure 2.2.

These structures reduce the magnitude of floods at the site.

In addition, there are many diversions for irrigation and municipal water supply. The nearest flood-control structure i

to the STP is Mansfield Dam which impounds Lake Travis. This dam is located about 301 mi upstream of the plant. Between Mansfield Dam and STP there is an uncontrolled drainage area of aboet 3580 sq mi.

The principal drainage feature in the STP site area other than the Colorado River is Little Rcbbins Slough shown in Figures 2.1 and 2.3.

This water course ficws south from the vicinity of the main cooling reservoir (MCR) to a coastal marsh area north of Matagorda Bay. The portion of Little Rcbbins Slough within the MCR area had to be relocated to facilitate ccnstruction of the reservoir embankment. As shown in Figures 2.1 and 2.3, the slough was relocated to a channel on the west side of the west embankment of the MCR.

The channel rejoins the natural drainage course abcut 1 mile east of the 2

southwest corner of the reservoir. Because of the lack of topographic definition in the marsh area south of the STP it is difficult to estimate with any certainty the size of the Little Robbins Slough drainage area. As well as can be estimated, the drainage area is approximately 28 sq mi.

Significant hydrologic features constructed for the STP, as shown on Figure 2.3, are the main cooling reservoir (MCR) and the emergency cooling pond (ErP). The MCR is formed by a 12.4 mi long earthfill embankment,

)

constructed above natural grcund. This embankment encloses a water surface

{

area of 7,000 acres at an elevation of 49 ft msl and impounds 202,700 j

acre-ft of cooling water for normal plant cperation. Emergency cooling water will be provided by the ECP which is a separate excavated pond l

surrounded by a dike. The ECP has a surface area of 46.5 acres at an t

elevation of 25 ft asi and impounds about 362 acre-ft.

1 i

e e

I l

I c

1'o PWCPERTY O

LIMITS

}

^

3 ESSENTIAL C00UNG I

. 7F SdTCM l

YARD (']l ta.o. sta ma samns l

PLANT ACCESS ROAD

, ptAny l

' *at' R l

VISITOR'S CENTER s.s.u. suas traumas l\\

tieyc,? es N

tc:::

"ci.*

g,+

j sESEY$ea 9

• tLL l WELL,'

g]

I L______3

/

WELLlh l

I F

MAKEUP I

esAiN coouwa nasanvoin f

, NEn'Es

$kgg l

4-4 NATURAL g

RENTED g 'e'

![ D NE g

l LCw ND LITTLE DIKE Y h h{ f, ',;n'*

S

/

l l

l t

I:

i I

++

l

/

I

,,s...

g,'.

l SPILLW AY &

EmaAnnwENT mLowoowN o

is6a=o g

l PACILITIES A/

I L.

_ L - _ -- __ -.

Q*['ae ff:

,,, s.- - - - 'L._ _ _.

.. _. ~,

---.y s

't i

1 I

fi

• e l

l I

i

.l i

s o

e a ns I

o mon Figure 2.3 HYDROLOGIC FEATURES Source:

FSAR Figure 5.3.A-1

_~

Makeup water for the MCR will be provided by the Colorado River and blowdown will be discharged back to the river downstream of the intake. For the ECP, makeup water will also be provided from the Colorado River. Wells will be provided as a backup supply for the ECP in the event surface water is unavailable. Figure 2.3 shows the locations of the intake and bicwdown structures for the MCR plus the locations of the water supply wells.

The Colorado River near the STP is used for intermittent irrigation. However, the proximity of the plant to the Gulf of Mexico causes the river to be i

brackish during much of the year, thereby limiting its use.

2.4.1.2 Groundwater Groundwater in the site area is found in a shallow aquifer of low quality water and a deep aquifer which produces higher quality water. These two aquifers are separated by a 150 ft thick aquiclude composed of predominately clay materials.

j ihe shallow aquifer occurs above depths ranging from 90 to 150 ft. However, j

because of its high dissolved solids, only minor amounts of groundwater are used. The primary use is for domestic and stock watering purpcses. Future use of groundwater from this shallow aquifer is not expected to increase significantly, primarily because of its poor water quality.

The deep aquifer lies belcw depths of 250 to 300 ft. Groundwater usage in the area is almost totally frcm this deep aquifer which produces water suitable for potable use. Groundwater usage frcm the deep aquifer is expected to in'c'rease in the future, primarily due to municipal and industrial requirements. Hcwever, this increase will be moderate because the existing small comunities downstream are not expected to substantially increase in size nor in associated water demands. Likewise industrial groundwater use which is very small will probably not increase significantly in the future. Refer to Section 2.4.12 for'a more detailed description of the groundwater resources in the area.

The applicant has provided hydrologic descriptions of the plant site and vicinity. The staff has reviewed the applicant's information in accordance with procedures in SRP 2.4.1 and 2.4.2.

The staff concludes that the require-ments of GDC-2 with respect to hydrologic descriptions have been met.

2.4.2 Floods 2.4.2.1 Ficod History The largest flood recorded on the Colorado River in the vicinity of the site occurred on June 26, 1960. During this flocd, the stream gaging station located about 16.5 mi upstream at Bay City, Texas recorded a stage of 48.2 ft ms1. The discharge corresponding to this stage was estimated to be 84,100 cfs. The applicant estimates that this flood would result in an elevation of 21 ft ms1 at the north end of the STP site under the channel conditions existing at this time. By comparison, the plant grade elevation is 7 ft higher at elevation 28 ft ms1.

There have been six other floods with higher stages than the June 1960 flood.

However, no official discharge estimates are available for these floods.

The maximum known stage at the Bay City gage site since 1869 is 56.1 ft ms1.

This event occurred in December 1913.

2.4.2.2 Flood Design Considerations Five pctential sources of flooding were considered by the applicant:

(1) intense local precipitation (2) floods on the Colorado River (3) dam and embankment failures (4) surges and seiches

.(5) tsunamis

The staff has reviewed the material presented by the applicant in accordance with procedures in SRP 2.4.2.

Based on this review, the staff concludes that there are no other credible sources of potential flooding of the plant site.

2.4.2.3 Effects of Intense Local Precipitation There are two local drainage areas adjacent to the STP. These are Little Rcbins Sicugh, a 4.5 sq mi drainage area which lies to the west and north-west of the plant; and a 0.6 sq mi drainage area which is located northwest of the plant.

The STP has a site drainage system designed for a 50 year rainfall event.

This is less than the Probable Maximum Precipitation (PMP) for the site so during a PMP event some water could pond on the site.

PHP is the estinated depth of precipitation (rainfall) for which there is virtually no risk of being exceeded. The PMP values used by the applicant, to estimate the depth of local flooding, were determined from Hydrometerological Report (HMR) 51 (U.S. National Weather Service 1978) and Engineering Manual EM 1110-2-1411 (U.S. Army, Corps of Engineers 1952). The applicant concluded that a PMP event, occurring over the 4.5 sq mi Little Robins Slough drainage area, would result in a Probable Maximum Flood (PPF) peak discharge of about 8,000 efs and a water level of about 32 ft ms1 on the site.

(Note that plant gride is 28 ft asi).

For the other drainage area which lies northeast of the plant, the applicant determined that flood waters would drain in an easterly and southeasterly direction away from plant structures. The critical peint of flow is the plant access road just south of the emergency cooling pond. Flood waters would pond against this road to the elevation of the top of the roadway and would then spill over The elevation of the access road in the vicinity of the spill area is abcut 30.75 ft msl for a length of about 700 ft. Assuming n-r

---

.--m,me m

---e-

~_ -,

,-me---,en.~+=----,me

the road in the spill area to be a broad crested weir, the applicant determined that a water level of 32 ft ms1 would result in a discharge of about 2450 cfs. For the 0.6 sq mi drainage area, this would represent a peak discharge of about 4080 cfs/sq mi or over two times the PMF peak discharge per square mile calculated for the 4.5 sq mi Little Robbins Slough drainage area. On this basis the applicant rationalized that the water level of 32 ft ms1 caused by a PMF on Little Robbins Slough wculd be higher than the PMF from the 0.6 sq mi drainage area northeast of the plant. Although a local flood level of 32 ft msl is fcur feet higher than the plant grade elevation of 28 ft asl, the applicant concluded that local PMP flooding is not critical to flood design because inundation of plant grade would be greater for the flood conditions discussed in Section 2.4.4.

I Roofs on safety-related buildings where pending could occur are surrounded l

by low curbs. During a PMP event, water would pond until it overtopped the l

6-in-high curbs and flowed over the side. The height of the curbs is l

designed so that the maximum ponding depth will not produce a load which exceeds the roof design loads of 50 lb/ft*.

Using the procedures described in SRP Sections 2.4.2 and 2.4.3, the staff reviewed the applicant's methods of runoff analysis for the site during the local PMP. The staff concludes that these methods are appropriate and acceptable. However, the staff does not agree with the procedure used by 4

the applicant to distribute the PMP into smaller time periods which are needed to assess flooding effects from local drainage areas. The procedure used by the applicant for PMP distribution is given in Engineerir.g Manual EM ll10-2-1411,,(U.S. Army Corps of Engineers 1952). A more recent procedure, which is considered by the staff to be more appropriate for distributing PMP, is given in HMR 52 (U.S. National Service, 1982). Using this report, the staff determined that PMF for Little Robins Slough would be about 12,000 cfs or 1.5 times the PMF estimated by the applicant. Hcwever, a flood of this magnitude would still result in water levels whicn would be lower than the 4

- ~ - -

.,-..-_...w,

,-,,vww-,.,,,,---,---,_n-we-----,

design basis flood levels discussed in Section 2.4.4.1.

The staff thus con-cludes that local flooding does not present a credible threat to the site and thus the plant meets the requirements of GDC-2 with respect to ficoding from a local PMP event.

2.4.3 Probable Maximum Floed on Streams and Rivers There are 22 dams on the Colorado River and tributaries upstream of the STP.

In addition, Columbus Bend Dam has been proposed for construction on the Colorado River.

Its location is about 124 miles upstream of the STP site. Figure 2.2 shows the location of these dams.

The Corps of Engineers, in conjunction with a hydrologic study related to the proposed Columbus Bend Reservoir, determined that a PMP storm centered over the uncontrolled drainage area below Mansfield Dam would produce a higher water level at Bay City than would a PMP storm centered over the area above Mansfield Dam or over the. entire Colorado River Basin. For this reason, the Colorado River Basin PMF studies for the STP site were confined to the uncontrolled area below Mansfield Dam.

Studies by the U.S. Army Corps of Engineers for the "U.S. Study Commission-Texas" show that all major upstream dams in the Colorado River Basin are capable of withstanding their PMF peaks. The applicant considered four possible PPE flows for the STP assuming that the upstream dams would be operating as designed.

In addition, consideration was also given to a hypothetical situation whereby a PMF for the entire contributing area of 1

the Colorado R1ver Basin above the STP site is assumed, with no credit taken for flood control in the numerous reservoirs upstream of the site. This hypothetical situation is the PMF flood that resulted in the highest water l

level at the STP site. The PMF peak for the entire 28,800 sq mi drainage I

area above STP was 1,750,000 cfs. The applicant estimated that a flood of this magnitude would result in a maximum stillwater level of 30.8 ft msl at l

._ ~

o I

the site. The applicant concluded that a PMF on the Colorado River is not critical to flood design because as discussed in Section 2.4.4.1, a flood caused by dam failures would result in a higher flood level at the site than a PMF on the Colorado River.

2.4.4 Potential Dam Failures i

2.4.4.1 Failure of Dams on the Colorado River The potential for failure of upstream dams was considered by the applicant.

Two dam failure scenarios were analyzed.

In the first scenario, Mansfield Dam which impounds Lake Travis, was assumed to fail after having received l

floodwaters from a failed Buchanan Dam. The resulting dam-break flood from Lake Travis/ Man, field Dam was routed downstream about 300 miles to the vicinity of the STP.

In the second scenario, Columbus Bend Dam which is a proposed project was assumed to be in existence and to fail upon receiving floodwaters from the failed Hansfield Dam. The resulting dam-break flood from Columbus Bend Dam was routed downstream about 120 miles to the plant site. For both dam failure scenarios, it was assumed that the lakes at the time of failure would be full to the elevation of the tops of dams and that the dam failures would be instantaneous.

An unsteady flow routing model was used to route the dam-break floods downstream to the site. River flow conditions at the time of failure were assumed to be at a stage corresponding to a flow equal to the Standard i

Project Flood (SPF) at Bay City. An SPF is about half as severe as a PMF.

The routing mod,el used was the National Weather Service's "DAMBRK" Program.

For the first scenario, i.e., without the proposed Columbus Bend Dam, the l

peak discharge at Bay City was found to be about 1.9 million cfs. The corresponding stillwater level at the site was 32 ft. ms1. The peak discharge at Bay City occurred about 65 hours7.523148e-4 days <br />0.0181 hours <br />1.074735e-4 weeks <br />2.47325e-5 months <br /> after the failure of Mansfield Dam. For the second scenario which assumes that Columbus Bend Dam is an existing structure that would also fail, the peak discharge was found to be about 1.8 million cfs and the corresponding stillwater level at the site was slightly lower at 31.7 ft ms1.

I i

During an extreme flood event, water would spread across a wide area on both l

sides of the Colorado River. Winds blowing across this. water could create waves that could result in water levels exceeding the maximum stillwater level of 32 ft. at the plant. The applicant estimated that water waves could result in water levels that could exceed the stillwater level at the plant by 11.4 ft. Adding this to the maximum stillwater level of 32 ft. resulted in a maximum water surface elevation of 43.4 ft.

The applicant's analysis of flooding from the Colorado River was reviewed and approved by the staff at the CP stage. During that review, the staff concluded that a maximum water surface elevation of 39 ft, ms1 was accept-able as a design basis for safety-related structures on the north side of the reactor buildings. The staff has reviewed the FSAR material in accordance with procedures described in SRP 2.4.2 ar.d 2.4.3.

Based on this review the staff has now determined that a flooU level of 43.4 ft. ms1 M conservative and thus acceptable for design of safety-related structures l

on the north side of,the reactor buildings.

(See Section 2.4.4.2 for design l

basis flood lev'e1Ifor structures that are no't, north of the reactor buildings.) Thus the plant meets the guidelines of RG 1.59, " Design Basis Floods for Nuclear Power Plants," and the requirements of GDC-2 with respect to flooding on the Colorado River.

2.4.4.2 Flooding-From Failute of the Ma'in Cooling Reservoir Embankment Cooling water for' normal operatio,n will be, provided by the main, cooling reservoir (MCR) located just south of the pl. ant. The MCR is formed by a 12.4 mi long non-seismic Category I earthfill' embankment constructed above natural ground. This embankment encloses a water surface area of about 7,000 acres and impounds about 202,700, acre-ft of cooling water at an

~

elevation of 49 ft msl.

By comparison", plant grade is at 28 ft ms1. The elevation of the crest of the embankment varies from 65.0 ft to 66.3 ft msl.

The crest elevation is no't constant because wind wave runup heights vary l

by perimeter location due to differences in fetch length. Because the MCR is above ground, its failure could potentially affect the safe operation of the plant, particularly on the north side where the centerline of the embanknent is only 800 ft south of the centerline of the power block.

l

At the CP stag 2, the applicant analyzed a hypothetical failure of the MCR embankment assuming several different breach lengths. That analysis showed that a 2,000 ft embankment section failing instantaneously would result in the highest water level against the power block. This water level was detennined to be 50.2 ft nsl. The power block consists of the Fuel Handling Buildings, Mechanical Auxiliary Buildings, Reactor Buildings and the Electrical Auxiliary Buildings. The applicabl.e R.G. used at the CP stage by the applicant in its embankment failure analysis and by the staff in its review, was an August 1973 version of R.G.1.59, " Design Basis Floods for Nuclear Power Plants." Since the CP stage, the R.G. has been revised. The current version of the R.G. which is revision 2 dated August 1977, endorses ANS-2.8, ANSI N170-1976, " Standards for Determining Design Basis Flooding at Power Reactor Sites." This ANS standard requires consideration of the effects of scour and erosion due to dam failures. The 1973 version of R.G. 1.59 did not have this requirement; consequently, the applicant's 4

analysis of a failure o'f the MCR embankment did not consider the effects of scour and erosion.

In the FSAR, the applicant refined its, analysis o a failure of the MCR embankment. However, in this' reanalysis, the applicant still used the 1973 version of R.G. 1.59. To assure that the reanalysis was conserva-tive, breach lengths of 400, 1,000, 2,000 and 4,000 ft were analyzed.

Again the 2,000 ft embankment breach resulted in the highest water level which was 50.8 ft against-the. south facd of the Fuel Handling Buildings

^

and the Mechanical Auxiliary Buildings. Flood protection design of the south, west and East sides of the rower block were based on the flood levels that would result from;'the MC,R breach. Maximum flood levels against the south side of the ECP and thd'so,uth side of its intake structure would also be caused by a failure of the MCR. Section 2.4.10 discusses the. effects of flooding on safety-related buildings.

L

- - -.. - -.~

o The applicant in a preliminary study determined that the erosion and scour associated with a failure of the MCR embankment had the potential to affect the structural backfill supporting the foundatins of seismic Category I structures. As a result, on August 30, 1983 the applicant infomed NRC Region IV that this item was potentially reportable pursuant to10CFR50.55(e).

Since the potential erosion and scour problems were identified, an evaluation of the integrity of the north portion of the MCR embankment facing the plant, has been performed by the applicant and structural modifications have been made where necessary. The applicant now concludes that the as-built MCR embankment opposite the power block will be stable and will perform satisfactorily under all anticipate loading conditions. Therefore, an adequate margin of safety can be maintained for all credible failure mechanisms. The failure mechanisms considefed were as follows:

1.

Emb'arikment stability a) Steady state seepage b) Rapid drawdown c) Seismic stability 2.

Seepajeandpiping a) Un'9erseepage b) EmbankmentseepAge 3.

Embankment overtopping during floods 4.

rosion' potential at penettations l

?

l l

The staff has reviewed the information provided by the applicant. As discussed in Section 2.5.6.4.3, the staff conclu' des that the postulated instantaneous failure of the MCR embankment will not o,ccur, therefore, it is not considered necessary to evaluate or incorporate measures to protect the structural backfill for scour or erosion. Thus the flood resulting from a breach in the cooling reservoir embankment is an acceptable design basis flood for the structures on the south, west and east sides of the power block. The staff therefore concludes that

~

the plant meets the requirements of GDC :2 with respect to flooding from a failure of the MCR embankment. For the north side of the power block and the ECP, the design basis flood levels were determined by assuming successive dam failures on the Colorado River as discussed in Section 2.4.4.1 of this report.

2.4.5 Probable Maximum Surge and Seiche Flooding TheSTPsitewhic!N.islocatedabout16" miles,from"theGulfCoastisunder

~

the hydrometeorological influence of the, Gulf;of Mexico. The applicant analyzed the storm surge frem the Probable Maximum Hurrican (PMH) as defined in Regulatory Guide 1.59, coincident with a 100-year flood on the Colorado River, and foupd th,e stillwater level at the. site to be.about 26.7 ft. This elevation is below the plant' grade elevation of 28 ft. High winds associated with the hurricane could cause additional runup. However, since the design basis flood level as discussed in Section,2.4.4.2 is over 50 ft. msl, the applicant concluded that the PNEcufd not.p,roduce the design basis flood at the site even if wave runup was considered.

=

i

..-..-..-.-..-m.

_._,_,...-_._,,7,

(

The staff reviewed the storm surge analysis at the CP stage and concluded that there was no potential danger to safety-related structures frem a PMH with coincident wind generated waves. The staff has now reviewed the FSAR material in accordance with procedures described in SRP 2.4.5.

Based on this review, the staff has now determined that there is no new information that would change the earlier conclusion. Thus the plant meets the guide-lines of R.G. 1.59, " Design Basis Floods for Nuclear Power Plants," and the requirements of GDC-2 with respect to flooding from hurricane induced surges.

Seiches are long period standing waves that can occur in lakes and the open coast. Since STP is located 16 miles inland, flooding at the site due to seiches in the Gulf of Mexico or Matagorda Bay are considered insignificant.

The passage of a hurricane over the site could induce a seiche in the MCR.

The applicant determined that a PMH would produce a sloping water surface with a maximum stillwater level rise of less than two feet at the northern l

end of the MCR. Once the wind abated, the water would oscillate toward the south side of the cooling pond. The southern end of the cooling reservoir is j

wider and deeper than the northern end so energy propagating from the northern end would be dispersed when it reached the southern end. Thus the amplitude of such oscillations would not be significant.

The staff has reviewed the applicant's seiche analysis, presented in the FSAR, in accordance with procedures in SRP 2.4.5.

The staff agrees with the applicant's conclasien that flooding of the site due to seiche effects would be insignifica.nt. Thus the plant meets the requirements of GDC-2 with respect to seiches.

2.4.6 Prcbable Maximum Tsunami Flcoding A tsunami is a gravity wave system that is created by a disturbance in the crust of the earth underlying large bodies of water and the resulting uplift of the water surface over a large area. There is no historical record of any

e f

4

[

+

l tsunami striking the coast in the Gulf of Mexico near the site area. Tsunami flooding along the Louisiana - Texas coast has never been reported. Thus the j

applicant concluded and the staff agrees that tsunamis are not a credible scurce of flooding.

l 2.4.7 Ice Effects i

A review of historical river water temperature data by the applicant revealed no reccrd of historical ice ficcding in the area of the plant site. Suffi-cient information for an analysis of water temperatures near the STP site

]

could not be obtained because only random observations were available for irregular intervals. Consequently, the river water temperature data at the i

USGS gage at Wharton, Texas was used. Since the USGS gage at Wharton is upstream of the site, tiie values used reflect lower temperatures and a more conservative estimate relating to the probability of ice produced flooding at the site. The data covers Octcber 1944 through September 1975 with scre gaps. The lowest river water temperature recorded was 35'F.

This occurred twice; on December 23, 1963, and on January 14, 1964.

Considering all available information, the applicant concluded that icing l

and ice flooding are not potential hazards at the site.

3

]

The staff concurs with the applicant that ice effects are not a credible design consideration.

2.4.8 Ccoling Water' Canals and Reservoirs The Emergency Cooling Pond (ECP) is the only safety-related reservoir onsite.

There are no canals associated with the ECP. The ECP is designed to remain functional during the design basis flood events discussed in Sections 2.4.4.1 and 2.4.4.2.

8 1

As shown on Figure 2.4, the ECP is an excavated pond having relatively flat 1 on 5 side slopes. The bottom of the pond is at elevation 17 ft. ms1 and the normal water level is 25.5 ft. ms1, 1.5 ft. lower than the surrounding ground level of 27 ft, ms1. The excavated ECP is surrounded by a dike having a crest elevation of 34 ft. ms1.

In addition, to prevent thermal short circuiting of the ECP, an interior dike with a crest elevation of 38 ft. msl is provided in the center of the ECP. The intake and discharge structures in the ECP, the interior dike, the 1 on 5 excavated slopes and the south and west portions of the ECP embankment are designed to withstand a safe shutdown earthquake (SSE). The seismic design of the south ECP embankment is required in order to demonstrate that it will remain intact following an SSE and, thus, be available to resist the hydraulic forces caused by a postulated loss of the Main Cooling Reservoir (MCR) enbankment.

Since the north and south portions of the ECP embankment are not required to resist the flood forces caused by a breach of the Cooling Reservoir embank-4 ment, they are not designed as seismic Category I structures. However, they are designed to resist the hydraulic forces resulting from a failure of upstream dans in the Colorado River. Section 2.4.10 provides a discussion of the effects on the ECP of a failure of the MCR. To protect against seismic events and erosion due to wave action, the interior dike and the west and south sides of the surrounding dike are lined with 6 inches of reinforced concrete. The north and east sides of the surrounding dike are lined with 15 inches of soil-cement.

The staff has reviewed the information provided by the applicant and con-cludes that the slope protection on the dikes is adequate to prevent erosion due to wind wav,e activity. Furthermore, the staff also concludes that the height of the dike, being 8.5 ft. higher than the normal water level, provides adequate freeboard to prevent overtopping of the ECP dikes during a PMP event coincicer.t with the effects of wind waves.

fo:J',Te**d?

.. I.<...

.t pi.'E / *"l.!?"'T d.h

... 5 *[ '.,I'.'"' N,',*.'.=

gL: urn':u:

T it M

.m',=1:.' :".. f. ( ]. ~ ty7_;::r. A:::,'t.;,;,;;' -'-

_ _ _ _k W

r.

B'i! :'n..

%'?" ->

~ " " ~ ' " ~

S

-A

\\~'<; ~; ~'

' N"""

=or so scu.

NOTE:

SHADED AREA REPRESENTS DESIGN BASED ON SEtSMIC CATEGOHf I.

((CW DISCHARGE STRUCTURE I RELOCATED i

IEMBANKMENTL F M 521 SWITCHYARD f g - t--

l I'

h ESSENTIAL COOLING PONDI L

.l g

[EC W INTAKE STRUCTURE]

[

' N s

,1, t

3 Na

\\

c

-a I

[

^

p h_ _.

K VISITOR'S 5

T T

CENTER

./

/~ f w,

/

~

a

~

%* j e-s t

_1_

A l 1

_1 1-k/

q'W DITH.

INTAKE soo soor.se PLANT ACCESS ROADI MAIN COOLING RESERVOIR s

Figure 2.4 ESSEllTIAL COOLING POND LAYOUT AND SECTI0ld Source: FSAR Figure 2.4.3-30

4.

o t

2.4.9 Channel Diversions The Colorado River is the source of makeup water for the MCR. The source of makeup water for the ECP is from the MCR or from onsite wells. Because the Colorado River is regulated by many upstream reservoirs, channel diversion is not considered to be a significant factor to the safety of the plant.

Hewever, even if the Colorado River did experience a channel change, the plant would not be affected because the emergency cooling pond is designed to provide sufficient cooling wattr to permit a safe shutdown and cooldown of both units and to maintain them in a safe shutdcwn condition for a period of at least 30 days assuming no makeup to the pond.

4 2.4.10 Flood Protection Requirements A failure of the north side of the MCR produces the design basis flood I

levels for all safety-related structures except for the north side of the j

emergency cooling water (ECW) intake structure where a sequence of postu-lated dam failures on the Colorado River resulted in a higher flood level than the MCR breach. The ECW intake structure is located as shewn on Figure 2.3.

With the exception of three openings as discussed below, all exterior seismic Category I structure openings are located above maximum water levels or are equipped with watertight doors or seals.

i l

There are three openings located below maximum water levels that are not equipped with watertight doors. These openings include the truck bay (Mechanical Auxiliary Building), the rail car bay (Fuel Handling Building),

and the Tendon Gallery Access Shaft cover. The applicant has stated that l

these areas are not protected from flooding because they do not have any i

safety-related systems and components.

In addition, the first two areas l

are separated from the remainder of the building by walls that do not I

i i

contain openings below the maximum surge-wave runup heights. The access cpening frcm the Tendon Galley into the MEAB will be provided with a water-tight door. The applicant has stated, in response to staff question 240.04N, that watertight doors will be under administrated control so they can be secured if conditions require (no alarm is provided).

An MCR embankment failure would not allow sufficient warning time to secure open doors if conditions required, as has been proposed by the applicant.

Therefore, the staff will require that administrative procedures assure that 1

waterprcof doors and knockout panels be normally in a closed position.

Additionally, door openings should be limited to less than 90' so that in the event of an embankment failure, open doors would automatically be closed by the rising water as it approached the plant.

If doors have to be opened 90* or more, administrative precedures should assure that plant personnel will be available to secure the open doors if necessary.

(Section 3.4.1 of this report provides further discussion on flood protection.)

A breach of the MRC embankment wculd result in a water level of 40.8 ft msl at the ECF. Since the crest of the dike surrounding the ECP is at elevation

]

34 ft ms1, and the interior dike is at 38 ft msl, a failure of the MCR embankment would totally inundate the ECP. The MCR embankment breach is the controlling flood even for the east, west and south faces of the ECW intake structure, the south and west sides of the embankment and the divid-ing dike. For the north face of the ECW intake structure and the north and east embankments of the ECP, a Colorado River Dam failure flood, which results in a static water level of 32 ft ms1 and a wave runup level of 43.4 ft msl, iA the controlling flood event.

The structures that wculd be affected by an MCR embankment breach are seismic Category I structures designed to withstand the dynamic and hydrostatic forces caused by a flood wave propagating from such a breach.

These strut'.ures include buildings in the power block area, the ECW intake and discharge structures, the excavated portion of the ECP and the south 1

i i

O i

and west embankments of the ECP.

In addition, to resist the erosive action of wind waves within the ECP,the embankment and the interior dike of the ECP are lined with either 6 inches of reinforced concrete or 15 inches of soil cement as shown in Figure 2.4 Thus, neither a breach of the MCR l

embankment nor erosion within the ECP will affect the stability of the ECP.

The Colorado River dam-failure flood discussed in Section 2.4.4.1 would result in a maximum wave runup height of 43.4 ft against the north and east 4

sides of the ECP embankment and the north face of the ECW intake structure.

The ECW intake structure, located as shown on Figures 2.3 and 2.4, is flood protected by waterproof doors to elevation 49.0 ft msl. Therefore a Colorado River flood will not affect the seismic Category I ECW intake l

structure. The ECW discharge structure is normally submerged so it also j

is unaffected. The north and east portions of the ECP embankment are not of seismic Category I design. However, they have the same cross-section as the seismic Category I embankment sections except they are lined with 15 inches of soil-cement instead of 6 inches of concrete. The north and west portions of the ECP are designed to withstand the hydraulic forces that would result from a dam-failure flood on the Colorado River. All embank-ments, whether Category I or not, are located 30 ft from the excavated portion of the ECP and thus will not affect the stability analysis of the excavated slope. The staff's review of the stability of the ECP embankment i

is described in Secticn 2.5. __.

2.4.11 Cooling Water Supply

(

The STP has two. sources of cooling water, the MCR and the ECP. The MCR provides water for cooling the main condensers and various nonsafety-related i

components in the Turbine Generator Building. The ECP supplies cooling water to various safety-related systems for normal plant operation as well as normal shutdewn during and after postulated Design Basis Accidents.

t

[

4

4 2.4.11.1 Normal Water Supply l

6 Under normal operating conditions, about 1.8 x 10 gpm are withdrawn from t

the MCR and pumped through the main condensers to receive the heat load given up by condensing steam. The heated water is returned to the MCR where it cools by evaporation. A smaller amount of water, about 23,60) gpm, is also withdrawn from the MCR for use in cooling mechanical equipment in the Turbine Generator Buildings. After passage through the turbine auxiliary heat exchangers, the heated water is also returned to the NCR for cooling, Makeup water for the MCR is obtained from the Colorado River through an i

intake structure located on the bank of the river opposite the station.

Figure 2.3 shows the location of the intake structure. The applicant considered the effect of low flows in the Colorado River on plant operation.

During a 7-year dry period in 1950 to 1956, no measurable discharge was 4

recorded at Bay City on several occasions so the probable minimum flow rate is zero. Should zero freshwater inflow occur during plant operation, the river opposite the plant would be occupied by tidal water because the tidal r

4 effects of the Gulf of Mexico extend about 8 miles upstream of the cooling reservoir intake structure.

The volume of water required to be stored in the MCR was determined from a hypothetical reservoir operation uitilizing 40 years of Colorado River stream flow data including the severe drought of 1950-1956. To protect the quality of the water in Matagorda Bay, pumpage frem the river.will not be allowed during periods when the flow at Bay City is less than 300 cfs. This restriction was, considered for the operation study. The MCR was sized to provide an adequate supply of cooling water through the entire 40 year historical sequence.

The staff concludes that since the MCR has sufficient storage to permit the plant to operate without any makeup during the period of record drought, the NCR provides a highly reliable source of cooling water. Thus the require-ments of GDC-44 with respect to having an adequate source of cooling water to dissipate heat under normal operating conditions have been met.

4 f

2.4.11.2 Emergency Cooling Water Emergency cooling water is provided by the ultimate heat sink.

The ultimate heat sink as defined in Regulatory Guide 1.27, " Ultimate Heat Sink for Nuclear Pcwer Plants," consists of the MCR and the ECP. The ability of the MCR to provide water for normal operation was discussed in the previous section. Cooling water for post accident shutdown and normal cooldown conditions will be provided by the ECP which is located as shown on Figures 2.1, 2.3 and 2.4.

The ECP is an excavated 9 ft. deep pond with i

an 8 ft.-high embankment that completely surrounds its perimeter. The pond 4

has a surface area of 46.5 acres and a storage volume of 343.8 acre-feet at an elevation of 25.5 ft msl. This is the minimum elevation for plant operation. Plant grade elevation is 28 ft msl.

The. applicant analyzed the ECP termal performance during two postulated events:

(1) the simultaneous shutdown and cooldown of both units and (2) the shutdown and cooldown of one unit concurrent with the dissipation of post-design-basis-accident rejected heat in the other unit. For event i

(1), the applicant calculated a maximum pond return temperature of 105.2*F and a r:aximum component cooling water (CCW) temperature of ll2.5'F. For event (2), the pond temperature was 104.6*F and the maximum CCW temperature was 120.5*F.

i The applicant's analysis also showed a maximum 30-day water loss of 184.2 acre-ft including seepage from the pond. At elevation 25.5 ft msl, the ECP contains about 343.8' acre-ft. Thus after 30 days, approximately 159.6 acre-ft of wate,r would remain in the ECP.

Based on its analyses, the applicant concluded that the plant meets the guidelines of Regulatory Guide 1.27, " Ultimate Heat Sink for Nuclear Power Plants." It is not clear to the staff how the applicant reached this i

conclusion because Table 9.2.2-1 in the FSAR shows that the design inlet

and cutlet temperatures of the CCW heat exchangers are both less than 120.5'F. Thus the applicant should provide additional information to justify its claim that a maximum CCW temperature of 120.5*F is adequate to meet the cooling requirements of the CCW. The applicant should also justify the ECP seepage loss rate used in its analysis.

The staff is currently conducting an independent evaluation of the thermal performance of the ECP. The results of this analysis will be furnished later.

2.4.12 Groundwater 2.4.12.1 Groundwater Description The Beaumont Formation which extends to a depth of about 1400 ft in the STP area, comprises the aquifer that supplies most of the groundwater in the area. Groundwater in this formation is confined under artesian pressure. The aquifer consists of two zones: a deep zone and a shallow zone. These two zones are effectively separated by an impervious stiff clay layer about 150 ft thick. Groundwater flows in the two zones are virtually opposite to each other. Water in the deep zone has a gradient of5to6ft/d3Ndandflowstowardsthenorthwest.

In the shallow zone, water flows to the southeast at a gradient of 1 to 3 ft/sec.

m i.k The deep aquifer zone which lies below depths of 250 to 300 ft in the site area provides water of acceptable quality fer irrigation and for domestic and ecs?. industrial uses. Piezametric levels in this aquifer, which is confinee by a 150 ft thick clay layer, range between 50 to 80 ft below the ground surface at the site. Recharge is by infiltration ~of precipitation and stream percolation at higher elevations north of the plant where the aquifer crops out. The recharge area begins 8 to 10 mi north of the plant and extends northward to beyond the Matagorda County boundary.

4 0

6 s

l The deep zene is an excellent aquifer having good quality water and a

[

hydraulic conductivity of about 3.85 x 10 ft/ day (13.6 cm/sec). Wells in 4

I the deep zone ccmmonly yield 1,000 to 2,000 gal / min with drawdowns of 40 to 100 ft.

The base of the shallow aquifer zone is 90 to 150 ft deep in the site area. The zone is divided into a lower and an upper unit. Pumping tests have shown that these two units are confined beneath a surficial clay layer and have piezametric levels ranging between 2 to 15 ft beneath the ground surface within the site boundary (the site boundary is shcwn on Figure 1

2.4.3).

The hydraulic conductivity of the lower unit is 85 ft/ day (0.03 cm/sec) and its porosity is about 0.37.

The upper unit has a hydraulic conductivity of about 14 ft/ day (0.005 cm/sec) and a porosity of

.i 0.35.

The recharge area for both the lower and upper units of the shallow aquifer is probably within a few miles north of the plant. Available data indicate that there is no significant recharge to the shallow aquifer from l

sources within or south of the plant area.

i Shallow zone water is generally inferior to that of the deep zone. Pocr quality shallow groundwater has been encountered in test borings in the i

plant site and cooling reservoir areas. Wells in this zone have limited production capability; thus, shallow groundwater is used only for stock j

watering and occasionally for domestic use.

i 2.4.12.2 Regional Grcundwater Use Regional ground. water use is minor with rice irrigation making the greatest demand.

In 1974, a total of 42,600 acre-ft was used in all of Matagorda County. Of this, 36,000 acre-ft was for irrigation (mostly rice). 4,600 acre-ft was for municipal use and 2,000 acre-ft was used for industrial purposes. Groundwater usage has not increased appreciably from these 1974 l

levels as indicated by the low level of well-drilling activity and the l

relative stability of rice production acreage.

i l

I L

_ _ _ _ _.. ~ _ _ _ _.. - _ _..

+

4 An estimate of groundwater usage within a 10-mile radius of the site was i

made in 1973. The estimated 1973 pumpage was 2,310 acre-ft with all but about 130 acre-ft coming frcm the deep zone aquifer.

i Groundwater usage from the deep aquifer is expected to increase moderately in the future, primarily due to municipal and industrial requirements.

However, the existing small communities are not expected to substantially increase in size.

Industrial use is very small and there is no basis for projecting large increases. Rice acreage may increase along with water demands. However, these variables cannot be predicted with any great degree of certainty, because market demands and federal control policies largely determine the extent of such growth.

The shallow aquifer zone is utilized only to a minor extent in the region north of the plant and is virtually unused within and downgradient of the site. Because of its poor quality, no significant asage downgradient of the site is anticipated.

i 2.4.12.3 Plant Ust Groundwater is used for certain plant operations including potable and sanitary purposes. The required groundwater is obtained from the deep j

aquifer by three wells which are located at least 4,000 ft from the power block, as shown on Figure 2.3.

Each well has a design capacity of 500 gal / min. Plant groundwater usage is estimated to average about 340 gal / min.

2.4.12.4 Design Basis for Subsurface Hydrostatic Loading As discussed in Section 2.4.12.1, the piezemetric levels in the shallow aquifer range from 2 to 15 ft below the ground surface within the site boundary. However, fer soils analysis and for analysis of structures below ground, groundwater level at ground surface was assumed. The applicant

i states that all analytical studies for structural design censidered the PMF described in Section 2.4.4 of the FSAR.

Seismic Category I structures are designed to resist the hydrostatic, hydrodynamic, and buoyancy forces that would result from the maximum ficed levels which are described in Section 2.4.4 of this report. The staff concurs that these flood levels meet the criteria of SRP 2.4.12 and thus concludes that the STP meets the criteria of 10 CFR 100, Appendix A and GDC-2 with respect to subsurface hydrostatic loadings.

2.4.13 Accidental Release of Liquid Effluents (To be provided later) 2.4.14 Technical Specifications and Emergency Operating Requirements As stated in Section 2.4.11.2, plant operation will be permitted only when the water level in the ECP is at or above elevation 25.5 ft ms1. Therefore, a technical specification will be required te define the actions to be taken in the event that the ECP water level drops below elevation 25.5 ft ms1.

The design basis flood for the majority of safety-related structures is a postulated failure of the main cooling reservoir (MCR) embankment (see Secticn 2.4.10). For the conservative scenario considered by the applicant whereby a 2,000 ft section of the MCR embankment is instantaneously removed, the resulting f1ced water wculd reach the south side of the power block area in about 38 seconds.

Therefore, there would not be sufficient warning time to institute adequate flood prevention measures. The applicant has not provided any alarms to signal when flood proof doors are open. Therefore, there must be a procedure to require that waterproof decrs and waterproof knockout panels be in a secured position under normal conditions. This procedure should define how open doors or panels would be secured in a 38-second time interval if conditions required.

_ -__ - =__-- - - - - - -

-Q t

i i

}

2.4.15 Conclusions i

The staff has reviewed the design of the STP with regard to hydrologically

)

and hydraulically related plant safety features according to procedures

)

outlined in the SRP. On the basis of this review, the staff concludes that

{

local flooding from extreme precipitation and large scale river flooding, i

either naturally occurring or induced by dam failures, pose no threat to

{

the safe operation of the plant. The staff concludes that the STP meets i

the requirements of GDC-2 with respect to potential ficed hazards.

i j

The staff has not ecmpleted its review of the thermal performance of the j

essential ecoling pond (ECP) nor its review of the potential for accidental

)

releases of liquid effluent. Thus the staff, at this time, cannot determine if the ECP meets the requirements of GDC-44 with respect to having an adequate amount of emergency cooling water nor whether the plant meets the requirements of 10 CFR 100 with respect to potential accidental release of contaminated liquid effluents. This draft SER will be revised pending completion of the staff's review.

l I

The follcwing information is required from the applicant to enable the i

staff to complete its review of the hydrologic aspects of STP.

1)

Additional information to show that the ECP has the capability of safely dissipating the heat from a design basis accident.

l 2)

A description of the emergency procedures that will assure that waterproof, doors and panels can be secured when necessary.

i r

1 2.4.16 References United States Study Comission on the Neches, Trinity, Brazos, Colorado Guadalupe, San Antonio, Nueces, and San Jacinto River Basins and Intervening Areas,1962, "The Report of the U.S. Study Comission-Texas, March.

U.S. Army Corps of Engineers, 1973, " HEC-2 Flood Hydrograph Package, Computer Program 723-X6-L2010." Hydrologic Engineering Center, Davis, California, October.

U.S. Department of the Army, Office of the Chief of Engineers, 1952, EM 1110-2-1411, Civil Engineering Bulletin No. 52-8, Standard Project Flcod Determinations Washington, March.

1 U.S. Naticnal Weather Service, 1980, " Comparison of Generalized Estimates of Probable Maximum Precipitation with Greatest Observed Rainfalls,"

NOAA Technical Report NWS 25, page 15,Itarch.

U.S. National Weather Service & Corps of Engineers, 1978, " Probable Maximum Precipitation Estimates, United States East of the 105th Meridian,"

Hydrometeorological Report No. 51, June.

U.S. National Weather Service & Corps of Engineers, 1982, " Application of Probable Maximum Precipitation Estimates - United States East of the 105th Peridian," Hydrometeorological Report No. 52, August.

U.S. Nuclear Regulatory Comission,1977, " Design Basis Floods for Nuclear Power Plants," Regulatory Guide 1.59, Revision 2, August.

U.S. Nuclear Regulatory Comission,1981, " Standard Review Plan for Review of Safety Analysis Reports for Nuclear Power Plants--LWR Edition",

i Section 2.4.2-FLOODS, NUREG-0800 (formerly NUREG-75/087), July.

U.S. Weather Bureau, 1956, " Seasonal Variation of the Probable Maximum Precipitation East of the 105th Meridian for Area frcm 10 to 1000 4

Square Miles and Durations of 6, 12, 24, and 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />."

Hydrcmeteorological Repcrt No. 33, April.

l

\\

l 1

i l

5 REACTOR COOLANT SYSTEM 5.2 Integrity of Reactor Coolant Pressure Boundary 5.2.2 Overpressure Protection Overpressure protection for STP has been reviewed in accordance with SRP 5.2.2 (NUREG-0800). Conformance with the acceptance criteria, except as noted, fomed the basis for the staff's conclusion that the design of the facility for overpressure protection is acceptable.

i The reactor coolant pressure boundary (RCPB) is protected from overpressuriza-tion by three pressurizer safety relief valves and two pressurizer power-operated relief valves in combination with the reactor protection system and operating procedures.

This combination of features provides overpressurization protection in accordance with the criteria of GDC 15; the ASME Code, Sec-tion III; and 10 CFR 50, Appendix G.

These criteria ensure RCPB overpressure protection for both power operation and low temperature operation (startup and shutdown).

Following is a discussion of overpressure protection for each mode of operation.

07/12/85 5-1 SOUTH TEXAS SER SEC 5 l

.o

5. 2. 2.1 Overpressure Protection During Power Operation Overpressure protection during power operation is provided by the pressurizer spray system, two power-operated relief valves (PORVs), and three spring-loaded safety valves (SVs), all of which are connected to the pressurizer.

The pres-surizer spray system is designed to maintain the reactor coolant system (RCS) pressure below the PORV relief setpoint of 2335 psig during normal design tran-sients.

The spray system flow is automatically modulated and can also be oper-ated manually from the control room.

The two PORVs are solenoid-operated valves, each with a capacity of 210,000 pounds of saturated steam per hour at 2350 psig.

They are designed to limit the pressurizer pressure to a value below the high pressurizer pressure reactor trip setpoint. The PORVs also have the purpose of limiting challenges to the SVs.

However, the SVs provide the fina,1 overpressure protection during power operation.

Both the SVs and PORVs have been designed to safety grade standards, except that the PORV actuation circuitry is control grade.

As stated in Section 15.6.3 of this SER, the applicant has yet to state whether the PORV is relied upon to perform a safety related task for the steam generator tube rupture event.

If it does, then the PORV actuation circuitry must be upgraded to safety grade standards to be acceptable.

Except for the main feed water (MFW) break accident, credit is taken only for the SVs in analyzing anticipated operational occurrences and postulated accidents.

In response to a staff inquiry, the applicant states that assuming PORV actuation for the MFW break accident provides a lower margin to RCS hot leg saturation and is thus more conservative.

As noted in Section 15.0, this event will be reanalyzed.

07/12/85 5-2 SOUTH TEXAS SER SEC 5

~.

In accordance with FSAR Table 5.4-15, each pressurizer SV has a relieving capa-city of 504,950 lb/hr at accumulation pressure (2560 psig).

The FSAR presently references WCAP 7769 as the document providing the generic methodology for safety valve sizing.

However, in response to staff inquiry 440.14, the applicant submitted a report titled " Overpressure Protection Report for STP As Required By ASME Boiler & Pressure Vessel Code Section III, Article NR-7300" April 1982. The methodology in this report differs somewhat from WCAP 7769, as will be discussed below.

The sizing of the pressurizer SVs was based on an analysis of a complete loss of steam flow to the turbine at 102% of engineered safeguards (ESF) design power, with no credit taken for operation of the pres-surizer PORVs, spray and level control system, rod control system, steam dump system and atmospheric dump valves.

The reactor was maintained at 102% power with no credit for reactor trip.

Credit was given for steam generator SV actuation.

Feedwater flow was assumed to be lost.

These assumptions are identical to those used in WCAP 7769, except that WCAP 7769 assumes that main feedwater flow is maintained.

Thus the STP Overpressure Protection Methodology appears to be somewhat more conservative than WCAP 7769.

For either analysis the SVs are sized to prevent the RCS from exceeding 2750 psia.

The above analyses were performed using the LOFTRAN Coda, a digital simulation that includes point neutron kinetics, reactor coolant system including the re-actor vessel, hot leg, primary side of the steam generator, cold leg, secondary side of the steam generator, pressurizer, and pressurizer surge line.

The pro-gram computes pertinent plant variables, including temperatures, pressures and power level.

This code has been reviewed by the staff and found acceptable.

l 07/12/85 5-3 SOUTH TEXAS SER SEC 5 L

l An analysis was also performed for a turbine trip from 102% power without direct reactor trip.

Reactor trip occurs due to high RCS pressure.

No credit is taken for steam dump.

Main feedwater flow is terminated at the time of turbine trip, and no credit is taken for auxiliary feedwater.

The reactor is in manual control.

Pressurizer PORVs and spray are not operating.

The resulting peak pressurizer pressure is about 2560 psia, and safety valve relief discharge flow is 60% of capacity flow.

In response to a staff inquiry, the applicant has stated that a time delay due to discharge of water in the safety valve loop seals was assumed in the analysis.

The steam system SV capacity is based on providing enough relief to remove 105%

of engineered safeguards design steam flow.

Twenty SVs are provided.

In re '

sponse to a staff inquiry, the applicant provided information that indicates that required minimum secondary relieving capacity can be provided with failure of one steam generator SV per loop.

The applicant's preoperational test program includes testing of pressur'e relief devices discussed in this section.

The evaluation of these preoperational tests is found in SER Section 14.

Additional testing of primary SVs, PORVs and block valves is required by NUREG-0737 Item II.0.1.

This has not yet been submitted by the applicant.

The evaluation of the applicant's compliance with II.D.1 will be included in SER Section 3.9.

07/12/85 5-4 SOUTH TEXAS SER SEC 5

s In response to NUREG-0737 Item II.D.3 the applicant stated that positive posi-tion indication will be provided for the PORVs.

The evaluation of the applicant's compliance with II.D.3 is included in SER Section 7.5.

The FSAR Chapter 15 safety analysis presently indicates the possibility of li-l quid or two phase flow relief in the event of a feedwater line break.

As discussed in SER Section 15.0, the applicant will reanalyze the main feedwater break accident.

If the new analysis still indicates the possibility of liquid or two phase relief, the applicant will be required to provide assurance that the dynamic loadings of the primary PORVs, block valves and safety valves due to liquid and two phase flow has been considered, including the effects on the continued operability of the valves and also in the piping and support analyses (including the passage of a water slug and the effects of water hammer).

Check valves in the discharge side of the high pressure safety injection, low pressure safety injection, and residual heat re[noval systems perfora an isola-tion function in that they protect low pressure systems from full reactor pres-sure.

The staff requires that these check valves be classified ASME IW-2000 Category AC, with the leak testing for this class of valve being performed to code specifications.

The applicant has stated that test lines and valves have been provided to adequately check that those check valves that serve to prevent backflow from the RCS into the safety injection system will perform their isolation function.

07/12/85 5-5 SOUTH TEXAS SER SEC 5 i

.c 5.2.2 Overpressure Protection During Low-Temperature Operation 1

The criteria for overpressure protection during low-temperature operation of the plant are in BTP RSB 5-2.

Low-temperature overpressure protection is provided by the Cold Overpressure Mitigation System (COMS) which includes the two pressurizer PORVs and the 4

interlocks for RCS pressure control during low temperature operation (SER Section 7.6).

The PORVs will have their opening setpoints automatically adjusted as a function of RCS temperature.

Two independent " protection sets" (i.e., interlocks) are provided.

The system will be manually armed by the operator below 350*F.

The RCS wide-range temperature measurements will be auctioneered to obtain the lowest value.

This temperature signal will then be sent to a function generator (in the same protection set) which has a PORV setpoint curve program.

This fucction generator will produce a calculated maximum allowable (reference) pressure for the prevailing temperature.

The reference pressura is then compared to the indicated RCS pressure from a wide-range pressure channel.

If the measured reactor coolant pressure approaches the maximum allowable pressure within a certain limit, an alarm is sounded on the riain control board indicating a pressurization transient.

If the reactor coolant pressure continues to increase, the PORVs are automatically opened to mitigate the pressure transient.

Thus, the system pressure will always be below the maximum allowable pressure.

This PORV setpoint curve shall be periodically updated, as shall be specified in the Bases for the Technical Specifications, to ensure that the stress intensity factors for the reactor vessel at any time in life are lower than the reference stress intensity factors as specified in 10 CFR 50, Appendix G.

An alarm is provided to remind 07/12/85 5-6 SOUTH TEXAS SER SEC 5 i

the operator to manually arm this system during cooldown.

The COMS has been designed as two separate trains in order to meet the single failure criteria.

In response to staff inquiry 211.12, the applicant states that the COMS is designed to the guidance of IEEE 279 and to function during an operating base earthquake.

No credit is taken for the RHR relief valves.

The applicant has provided conflicting information regarding the postulated worst case mass input.

In FSAR Section 5.2.2.11.2 it is stated that "the mass input analysis was performed assuming letdown isolation with two charging pumps operating in a configuration producing maximum delivery rates" and that only one PORV was assumed to be available for pressure relief.

In the response to staff inquiry 440.23 the applicant states:

"In the COMS analysis it assumed only one charging pump is operable below the arming temperature of COMS (typi-cally 350*F). The Technical Specifications are written such that all other charging /SI pumps are locked out." We require that the applicant provide clarification regarding the maximum COMS capacity, assuming a single failure.

If the response to question 440.23 is correct, then the applicant must provide an analysis which demonstrates that, with failure of the one operational char-ging pump, either due to failure of the pump itself or its electrical power supply, the plant will not be placed in an unsafe condition.

Consideration of loss of reactor coolant pump seal injection and need for emergency boration following a baron dilution event must be included.

An event with the potential of greater mass addition than that of 2 charging i

pumps would be the inadvertent actuation of a high head safety injection (HHSI) pump.

The applicant has indicated that HHSI pumps and accumulator isolation I

valves will be locked out at 1000 psig and 425'F during cooldown.

The STP 07/12/85 5-7 SOUTH TEXAS SER SEC 5

4 l

technical specifications will include these requirements.

(See also SER Sec-i tion 6.3 regarding LOCA during shutdown).

The heat input analysis was performed for an inadvertent reactor coolant pump (RCP) start assuming that the RCS was water solid at the initiation of the event and that a 50*F mismatch existed between the RCS and secondary side of the steam generators.

The heat input analysis took into account the single failure criteria.

The applicant states that the allowable limits will not be exceeded.

The staff requires technical specifications on the maximum permis-sible primary-secondary temperature mismatch before starting a RCP if the pres-surizer is water solid.

The applicant must also provide PORV setpoint values in the technical specifications.

The staff will report on these in the SER on technical specifications.

The applicant has not yet submitted Item II.G.1 of NUREG-0737 regarding whether the PORVs and associated block valves have safety grade power supplies.

However the applicant's response to staff question 440.23 states that the interlocks for RCS low temperature pressure control are provided with redundant Class 1E power.

i The applicant has submitted the limiting Appendix G curves.

This is evaluated in SER Section 5.2.3.

5.2.2.3 Conclusions i

Subject to the reanalysis of the main feedwater break accident showing that li-quid relief does not occur, the staff concludes that overpressure protection 07/12/85 5-8 SOUTH TEXAS SER SEC 5

O O

for normal temperature operation meets the relevant criteria of GOC 15 and 31 and is, therefore, acceptable. This conclusion is based on the following:

The overpressure protection system prevents overpressurization of the RCPB under the most severe transients and limits reactor pressure during normal operational transients.

Overpressurization protection is provided by three safety valves.

These valves discharge to the pressurizer relief tank through a common header from the pressurizer.

The pressurizer safety and power-operated relief valves, in conjunction with the steam generator safety and atmospheric steam dump valves in the secondary system, and the reactor protection system, will protect the primary system against overpressure.

The peak primary system pressure following the worst transient is limited to the ASME Code allowable value with no credit taken for nonsafety grade relief systems.

STP was assumed to be operating at design conditions (102% of ESF power) and the reactor is shut down by a high pressurizer pressure trip signal.

The calculated pressure is less than 110% of design pressure.

The staff can not presently conclude that the STP COMS meets the relevant acceptance criteria for low temperature overpressure protection until the applicant clarifies the COMS design mass input.

If the COMS capacity is limited to the runout flow of one centrifugal charging pump, then the applicant must assure by technical specifications that the other centrifugal charging pump is locked out at 350*F during cooldown and provide a single failure analysis that demonstrates that failure of the operable charging pump will not place the plant in an unsafe condition.

07/12/85 5-9 SOUTH TEXAS SER SEC 5

s 5.4.7 Residual Heat Removal System The design of the residual heat removal system (RHRS) for STP has been reviewed in accordance with SRP 5.4.7 and Branch Technical Position RSB 5-1 of NUREG-0800.

Conformance with the acceptance criteria formed the basis for the staff's conclusions regarding the acceptability of the RHRS design.

The RHRS has three separate and independent cooling trains, which are designed for a pressure of 600 psig and a temperature of 400*F.

Each train is connected to a different RCS loop.

Each train has a 34C0 gpm pump and a heat exchanger that is designed to transfer 39.4 million Stu/nr to the component cooling water.

The pumps, heat exchangers, and isolation and control valves are all located inside of containment.

Each train of the RHRS is powered by a separate vital bus.

The RHRS operates in the following modes:

(1.) Emeroency Core Cooling System, Infection and Recirculation Mode Provides long-term cooling during the injection and recirculation phase fol-lowing a LOCA when RCS pressure drops below the low head safety injection (LHSI) pump shutoff head.

(Note:

the LHSI pumps are used for ECCS only, as described in Section 6.3).

ThisfunctionisaccomplishedbyaligningtheRHRS to take fluid from the LHSI pump, cool it by circulation through the RHR heat l

exchangers, and supply it to the cold legs of the RCS.

Flow paths are also l

l available for hot-leg injection during the long-term recirculation mode to l

prevent boron precipitation in the reactor core.

07/12/85 5-10 SOUTH TEXAS SER SEC 5

i

.o (2) Refueling At the start of refueling, the LHSI pumps are used to transfer refueling water between the refueling cavity and the refueling water storage tank (RWST).

During refueling, the RHRS is maintained in service to provide a heat removal function to accommodate the heat load, utilizing the RHR pumps.

The RHR pumps also transfer water back to the RWST at the end of refueling.

(3) Shutdown When the RCS pressure and temperature are reduced to 350'F and 400 psig, the RHRS is placed in normal operation to remove fission product decay heat and bring the plant to cold shutdown conditions.

(4) Startuo Connected to the chemical and volume control system (CVCS) via the low pressure letdown line to control reactor coolant pressure.

The RHRS is designed to remove heat from the RCS after the system pressure and temperature have been reduced to approximately 400 psig and 350*F, respectively, by the steam and power conversion system.

Under normal conditions, with three trains operating, it would take about 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to get the reactor coolant temperature down to 200'F.

With two trains operating, the RHRS will reduce the temperature from 350*F to 200 F in about 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />.

If there is only one train operating it would take about 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> to reduce the reactor coolant temperature to 200 F.

07/12/85 5-11 SOUTH TEXAS SER SEC 5 6

O 5.4.7.1 Functional Requirements RSB 5-1 stipulates that the design of a plant shall be such that it can be taken to cold shutdown by using only safety grade systems and that these systems shall satisfy GDC-2, 5, 19 and 34.

Compliance with these criteria is as follows:

GOC-2, design bases for protection against natural phenomena for safety grade system, is evaluated in SER Section 3.

The RHRS is housed inside containment and is designed to seismic Category I.

It is thus protected from the effects of earthquakes and tornadoes.

GDC-5 is complied with because these RHRS's are not shared between units.

To comply with the redundancy criteria of GDC 34 the RHRS has three independent trains.

Fission product decay heat and other residual heat from the reactor core is transferred to the component cooling water system at a rate such that specified acceptable fuel design limits and reactor coolant pressure boundary design conditions are not exceeded.

Leak detection for the RHRS is discussed in Section 5.2.5 of this SER.

Isolation valve and power supply redundancy are discussed in Section 5.4.7.3.

The staff has reviewed the description of the RHRS and the piping and instrumentation diagrams to verify that the system can be operated with or without offsite power and assuming a single failure.

The three RHR pumps are connected to separate buses that can be powered by separate diesel generators in the event of loss of offsite power.

This is further described in 5.4.7.3.

07/12/85 5-12 SOUTH TEXAS SER SEC 5

o GDC 19 states that a control room shall be provided from which actions can be taken to maintain the plant in a safe condition under accident conditions, in-cluding loss-of-coolant accidents.

SRP 5.4.7 stipulates that the control of the RHRS be such thet the cooldown function can be performed from the control room assuming a single failure of any active component, with only either onsite or offsite electric power available.

Any operation required outside of the control room is to be justified by the applicant.

The applicant indicates in FSAR Section 5.4.7 that the RHRS is designed to be fully operable from the control room for normal operation and also in the event of malfunctions.

The staff has ascertained that the accumulator isolation valve switches and motor power supply breakers can be operated from the contol room during shutdown.

The applicant states that the RHR inlet isolation valve power supply breakers i

will not be locked open during any mode of operation and thus the valves can be operated from the control room. The STP design thus presently meets SRP 5.4.7 with regard to system operability from the control room (Note to PM:

ASB is currently reviewing the STP design for compliance with 10 CFR Part 50 Appendix R.

This review may result in requiring that the inlet isolation valve power supply breakers be locked open. This may change our conclusion regarding a

conformance with SRP 5.4.7).

5.4.7.2 Cold Shutdown Capability Branch Technical Position (BTP) RSB 5-1 states that the design should be such that the reactor can be taken from normal operating conditions to cold shutdown using only safety grade systems.

The auxiliary feedwater system (AFWS), along with the steam generator atmospheric dump valves, provide the safety function of decay heat removal and cooldown to RHR cut-in conditions.

(See SER t

' 07/12/85 5-13 SOUTH TEXAS SER SEC 5

~

j Section 10.4.9 for AFWS evaluation.) BTP RSB 5-1 states that the seismic Cate-gory I water supply shall have sufficient inventory to permit operation at hot shutdown for at least 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, followed by cooldown to RHR cut-in conditions.

The inventory needed for cooldown shall be based on the longest cooldown time needed with either only onsite or only offsite power available with an assumed single failure.

STP is considered a " Class 2" plant with regard to compliance with BTP RSB 5-1 requirements.

The safety grade auxiliary feedwater (AFST) storage tank has a capacity of 500,000 gals.

The present design does not provide safety grade backup to the AFST.

FSAR Table 5.4.A-1 states that this capacity is adequate to support 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> at hot standby followed by 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> cooldown to RHR cut-in condition, with a margin for contingencies.

The applicant has identified the most limiting failure as the loss of "A" train AC power, which results in the loss of two ADVs and AFW trains.

The staff requested clarification whether the j

above cooldown times considered this failure, and also additional information regarding the cooldown method.

The applicant has not provided a response to this inquiry.

I BTP RSB 5-1 also specifies the need for surveillance of boron concentration.

FSAR Table 5.4.A-1 states that boron sampling is not required during cooldown to cold shutdown.

The staff's position is that periodic boron measurements are necessary, particularly if the plant is in natural circulation.

The applicant stated that a response will be provided in September 1985.

The staff will provide the evaluation of STP compliance with BTP RSB 5-1 cold shutdown and baron measurement requirements in the final SER.

l 07/12/85 5-14 SOUTH TEXAS SER SEC 5

L 5.4.7.3 RHRS Isolation Requirements 4

The RHRS valving arrangement is designed to provide adequate protection to the RHRS from overpressurization when the reactor coolant system is at high pressure.

There are two separate and redundant motor-operated isolation valves (MOVs) be-tween each of the 3 RHRS pump suction lines and the RCS hot legs. These valves are separately, diversely, and independently interlocked to prevent valve open-ing until the RCS pressure falls below 425 psig.

If the valves are open, they are separately, diversely, and independently interlocked to close when the RCS pressure rises above 750 psig.

I Each RHR pump is connected to a separate and independent A.C. electrical standby bus.

For each train, all valves which require electrical power, except 4

for the outermost (from the RCS) inlet isolation valve, are connected to the same bus as their corresponding pump.

The outermost inlet isolation valve in each train is connected to a bus which is powered by a standby bus that is both separate and independent of the source which supplies that train's pump and is also separate and independent of the sources which supply the outer isolation valves in the other two trains.

Thus, the most severe single failure, i.e.,

loss of one emergency power diesel generator with loss of offsite power (LOOP),

would not prevent isolation of the RHRS nor will it cause isolation of all RHR trains.

To provide diversity, the two valves in each train receive pressure signals from different pressure transmitters corresponding to the power train that supplies the valve.

ThisisfurtherevaluatedinSERSectioni.6.

l 07/12/85 5-15 SOUTH TEXAS SER SEC 5 1

FSAR Figure 5.4-6 indicates that the open permissive and autoclosure interlocks are part of the ESF controls.

Since STP does not plan to lock the RHR inlet isolation valve motor power supply breakers open while at power, the staff was concerned that an ESF signal coupled with a control system failure could result in spurious opening of one or more inlet isolation valves.

The applicant has stated, and the staff has independently verified, that the control system design precludes this from happening.

There are two check valves and a normally open MOV on each RHR discharge line. 'The two check valves protect the system from the RCS pressure during normal plant operation.

The applicant has provided design features to permit leak testing of the check valves with tne RCS pressurized to fulfill the staff requirements for high/ low pressure isolation with two check valves.

The staff finds that the design of the RHRS isolation system satisfies the criteria of BTP RSB 5-1 and is acceptable.

5.4.7.4 RHR Pressure Relief Requirements Overpressure protection for each RHR train is provided by a relief valve on the pump discharge line.

The relief valve set pressure is 600 psig, which includes system pressure and the RHR pump developed head.

Each relief valve has a capacity of 1100 gpm at 600 psig, which is sufficient to discharge the combined flow from all charging pumps at the relief valve setpoint.

The fluid discharged by these relief valves is collected in the pressurizer relief tank (PRT).

Compliance of these valves with huREG-0737 Item II.D.1 is evaluated in SER Section 3.9.3.

Thermal relief valves are located on the RHR heat exchanger 07/12/85 5-16 SOUTH TEXAS SER SEC 5

v 4

bypass lines.

The fluid discharged by these valves is also collected in the PRT.

There are no relief provisions that would accommodate expansion of fluid between the two inlet isolation valves during plant warmup.

As a result of a staff request, the applicant has investigated the need for provision of a relief valve or other means of accommodating expansion, and has concluded that l

overpressure protection to accomodate thermal expansion of the water trapped i

between the two inlet isolation valves is not required.

The inlet valves are l

l not close coupled to the RCS loop piping and there is a cold trap between the RCS loop and the first inlet valve, arranged to preclude the formation of convection currents of hot reactor coolant which could heat the water volume l

l between the two inlet valves.

The effects of conduction are negligible.

The l

I only mechanism for heatup would be the increase in containment ambient I

temperature from 65'F to 120*F.

The results of the analysis indicate that the peak pressure between the two valves in less than the design pressure of the l

piping and isolation valves.

i The staff concludes that the RHR relief requirements satisfy the criteria of BTP RSB 5-1 and are accetpable.

l I

l 5.4.7.5 RHR Pump Protection l

The RHR pumps are protected from overheating and loss of suction flow by miniflow bypass lines.

A remote manually controlled on-off valve and orifice 07/12/85 5-17 SOUTH TEXAS SER SEC 5 l

L

o j

are located in each bypass line.

Pump minimum flow is established remotely at startup. An alarm and pump trip occur in the event of insufficient flow.

i l

A pressure sensor in each pump discharge line provides an alarm in the event of

{

excessive discharge pressure.

As noted above, relief valves are also located i

j in the pump discharge' lines.

i 1

I

{

]

The RHR pump mechanical seals are cooled by component cooling water (CCW).

In

]

response to a staff request, the applicant indicated that a high seal exit CCW temperature would initiate a computer alarm.

Loss of CCW during pump operation j

would result !a higher seal unit temperatures and consequently shorten seal

)

{

lifetime, but would not require a rapid pump shutdown.

The staff requested additional information concerning the possibility of air i

1 5

l binding of the RHR pumps during and following maintenance when the RCS has been j

(

l partially drained, improper RCS level control, partial loss of primary l

4 inventory or operating the RHRS at an inadequate net positive suction head (NPSH).

In response, the applicant stated that maintenance of proper RCS level l

f l

would be effected by the use of Westinghouse operating procedures.

If the steam generator tubes had to be drained, the RHR flow rate would be reduced to prevent vortex formation at the RHR hot leg connection.

The RHR pump NPSH has i

)

been calculated conservatively, assuming the RCS water level at the reactor

}

vessel nozzle midplane, and the fluid at the saturation pressure for 150*F, due l

1 to the effect of vacuum degassing.

Under the.e conditions, the NPSH is more l

than adequate.

Pump air binding would be indicated by low flow alarms.

The I

e system can be vented and the level raised to restore an airbound pump to I

operational status.

ll t

07/12/85 5-18 SOUTH TEXAS SER SEC 5 l

i f

The staff finds that the RHR pump protection features satisfy the criteria of BTP RSB 5-1 and are acceptable.

5.4.7.6 Test and Operational Procedures BTP RSB 5-1 states that the preoperational and initial startup test program shall be in conformance with Regulatory Guide 1.68.

The program for PWRs shall include tests with supporting analysis to (a) confirm that adequate mixing of borated water added prior to or during cooldown can be achieved under natural circulation conditions and permit estimation of the times required to achieve such mixing, and (b) confirm that the cooldown under natural circulation condi-tions can be achieved within the limits specified in the emergency operating procedures.

Comparison with performance of previously tested plants of similar design may be substituted for these tests.

In response to a staff inquiry regarding natural circulation mixing and cooldown testing, the applicant indicated that the Diablo Canyon test results would be representative for STP natural circulation because of the similarity between plants with regard to piping, components and elevation head.

The applicant estimates that the natural circulation loop flow rate for the two plants would differ by not more than 5 percent, and the upper head flow rates by not more than 3 percent.

The applicant will review the results of the Diablo Canyon tests for applicability.

Until the applicant reviews the Diablo Canyon test results and satisfactorily demonstrates that these results are applicable to STP this remains an open item, i

07/12/85 5-19 SOUTH TEXAS SER SEC 5

4 1

i r

The evaluation of the STP RHR$ preoperational test program including conformance to R.G. 1.68 is contained in SER Section 14.0.

i i

5.4.7.7 Post-Accident Qualification of RHRS I

i i

]

The FSAR presently indicates that neither the RHR pumps nor the inlet isolation j

i valves are designed to operate under the environmental conditions following a i

postulated accident (i.e. large or small break LOCA, steam line or feedwater line break inside containment).

The RHR pumps are presently designed for con-tainment ambient temperature (120*F).

Section 5.4.7.1 indicates that the RHR j

inlet isolation valves could be subject to flooding while those RHR valves that i

{

are " required to function after a LOCA" (presumably as part of the ECCS) are not subject to flooding.

Information regarding the design of these valve j

motors for the post-accident containment pressure, temperature, humidity, and i

l radiation condition is not yet available.

j i

j The staff requested that the applicant discuss whether the RHRS components are qualified for the environmental effects of large and small break LOCAs and i

1 j

steam line breaks, and how long term mitigation of these accidents would be accomplished.

An example would be a small break LOCA caused by a PORV or CVCS i

i failure which is subsequently isolated.

[

l The applicant has not yet resoonded to this inquiry.

Therefore qualification i

}

j of the RHRS to post-accident conditions remains an open item until resolved.

The staff will provide its evaluation in a SER supplement.

i t

l 5.4.7.8 Conclusions j

l 07/12/85 5-20 SOUTH TEXAS SER SEC 5 i

The RHR function is accomplished in two phases:

the initial cooldown phase and the RHRS operation phase.

In the event of loss of offsite power, the initial phase of cooldown is accomplished by use of the auxiliary feedwater system and the atmospheric dump valves.

This equipment is used to reduce the reactor coolant system temperature and pressure to values that permit operation of the RHRS.

The review of the initial cooldown phase is discussed in Sections 5.4.7.2, 10.3 and 10.4 of this SER.

The review of the RHRS operational phase is discussed below.

The RHRS removes core decay heat and provides long-term cooling following the initial phase of reactor cooldown.

The scope of review of the RHRS included piping and instrumentation diagrams, failure modes and effects analysis, and design performance specifications for essential components.

The review has evaluated the applicant's proposed design criteria and design bases for the RHRS and associated analyses to demonstrate conformance to these criteria and bases.

The staff review of the RHRS failure modes and effect analyses found these analyses acceptable.

ThestaffconcludesthatthedesignoftheRhiRSmeetstherelevantcriteriaof GDC 2, 5, and 19.

This conclusion is based on the following:

(1) The applicant has met GDC 2 with respect to the seismic design of the RHRS and structure housing.it, and has also met Position C.2 of RG 1.29 concerning the seismic design cf systems, structures, and components whose 07/12/85 5-21 SOUTH TEXAS SER SEC 5

failure could cause an unacceptable reduction in the capability of the RHRS.

Tnis is further discussed in SER Section 3.2 (2) The applicant has met the criteria of GDC 5 with respect to sharing of structures, systems, and components by stating that the RHRS is not shared with another unit, i.e., each STP unit has a separate RHRS.

(3) The applicant has met GDC 19 with respect to the main control room requirements for normal operations and shutdown.

However, the applicant is not in full compliance with GDC 34 since compliance with the following positions of BTP RSB 5-1 have not been fully demonstrated:

(1) The capability for cooldown to cold shutdown within a reasonable time period with only safety grade equipment and water sources, LOOP and most severe single active failure (2) Monitoring of boron concentration during cooldown to cold shutdown (3) Natural circulation and boron mixing test program The STP RHRS design also does not presently meet the long term post LOCA cool-down requirements of 10 CFR 50.46 and the environmental design requirements of GDC-4 with regard to post accident operability of the RHRS to provide long term tooldown.

The applicant will provide additional information on this subject.

The staff will provide its evaluation in a SER supplement.

l 07/12/85 5-22 SOUTH TEXAS SER SEC 5 l

5.4.12 Reactor Coolant System High Point Vents 10 CFR 50.44(c)(3)(iii) requires all light water reactors to have remotely operable high point vents on the reactor coolant system and on the reactor vessel head.

This requirement is supplemented by guidance in SRP 5.4.12 and NUREG-0737 Item II.B.1.

The STP reactor vessel head vent system (RVHVS) consists of 2 parallel paths with redundant isolation valves.

The system is designed to mitigate a possible condition of impaired natural circulation resulting from the accumulation of noncondensible gases in the RCS following a beyond design basis event.

The system is part of the reactor coolant system pressure boundary (RCPB), and therefore must comply with RCPB requirements.

In FSAR Section 5.4.15 the applicant states the following about the RVHVS:

1.

The active portion of the system consists of four one-inch open/close solenoid-operated isolation valves connected to a 1" vent pipe located near the center of the reactor vessel head.

2.

All piping and equipment from the vessel vent up to and including the second isolation valve in each flow path are designed and fabricated in accordance with ASME Section III, Class 1 requirements.

3.

The piping and equipment in the flow paths from the second isolation valves to the modulating valves are designed and fabricated in accordance 1

07/12/85 5-23 SOUTH TEXAS SER SEC 5

with ASME Section III, Class 2 requirements.

The remainder of the piping is Seismic Category 1, nonnuclear safety.

4.

The isolation valves in one flow path are powered by one vital power supply and the valves in the second flow path are powered by a second vital power supply.

The isolation valves are fail closed, normally closed valves.

5.

The system is operated from the control room or the shutdown panels.

The isolation valves have stem position switches.

The position indication from each valve is monitored in the control room or the shutdown panel by position indication lights.

The throttling valve position indication is provided in the control room and shutdown panel.

The applicant has evaluated the possibility of inadvertent actuation of the reactor vessel head vent system and states that no single active failure will preclude reactor vessel head venting er venting isolation.

The staff has reviewed this design and concurs with th's conclusion.

The pressurizer may be vented by opening one or both of the powar operated relief valves.

Noncondensible gases can be removed frcm the steam generator U-tubes by fill and vent procedures.

The applicant has met the requirements of 10 CFR 50.44(c)(3)(iii) and TMI Item II.B.1 by

',1) providing vent paths for the vessel head and pressurizer 07/12/85 5-24 SOUTH TEXAS SER SEC 5

~

L j

(2) providing remote operation from the control roum 1

(3) providing environmentally and seismically qualified components and power sources for the vent systems (4) providing redundancy to assure venting operation including redundancy of i

]

power supply i

l The applicant has committed to including the RVHVS in the STP inservice inspec-i tion program.

The reactor systems aspects of the reactor coolant system vents have been re-viewed, and the staff concludes that they meet the requirements of NUREG-0737 and are, therefore, acceptable.

l 1

i The FSAR states that a break in the RVHVS line would result in a LOCA no greater than 1 in, diameter. The applicant must provide additional information to demonstrate that the isolation valves are capable of closing against the dynamic forces associated with a broken vent line, or provide a flow j

restriction that would result in leakage flows lower than the LOCA definitions f

in the event of a pipe break.

i l

l 07/12/85 5-25 SOUTH TEXAS SER SEC 5 l

_ _ _ - _ _ _ _ _ _ _ _ _. ~

i o

I I

I I

t i

L r

6.3 Emeraency Core Cooling System

[

f i

I l

The staff has reviewed the STP emergency core cooling system (ECCS) in accor-i j

dance with SRP Section 6.3 (NUREG-0800).

As specified in the SRP, the design i

j of the ECCS was reviewed to determine that it is capable of performing all of l

the functions stipulated in the acceptance criteria.

The ECCS is designed to j

L 1

provide core cooling as well as additional shutdown capability for accidents

)

I that result in significant depressurization of the reactor coolant system t

]

(RCS). These accidents include mechanical failure of the RCS piping up to and l

including the double-ended break of the largest pipe, rupture of a control rod i

1 e

i drive mechanism, spurious relief valve operation in the primary and secondary I

fluid systems, breaks in the steam piping, and steam generator tube rupture.

I l

i The principal bases for the staff's acceptance of this system are conformance to 10 CFR 50.46 and Appendix K to 10 CFR 50, and GDC 2, 5, 17, 27, 35, 36, and I

j 37.

1 6.3.1.

System Design

i The STP ECCS consists of a refueling water storage tank (RWST), 3 safety injec-t I

tion ($!) trains, and 3 cold leg accumulators.

The ECCS discharges to RCS l

{

loops 1, 2, and 3.

Each SI train and accumulator discharge to one RCP loop, I

i with no interconnections between trains downstream of the 51 pumps.

l I

i l

I l

l 07/12/85 6-1 SOUTH TEXAS SER SEC 15

The RWST is a seismic Category I tank and is designed to provide an adequate supply of water borated to 2500-2700 ppm to the SI and containment spray pumps during the injection phase of the design base LOCA.

In response to a staff inquiry, the appitcant stated that the tank has a total volume of 531,800 gal.

Also a result of a staff inquiry the applicant provided additional information regarding the sizing of the RWST including the allowances made for instrument error, unusable volume, transfer allowance (for completion of switchover from injection to recirculation) and working allowance (volume between the high level and low level alarm that can be used during normal operation as makeup to the spent fuel pool), indicating a minimum usable value of 354,000 gal.

In response to a staff inquiry regarding the allowable RWST temperature range the applicant stated that the RWST is located inside the Mechanical / Electrical Auxiliary Buf1 ding (MAB), which is maintained between 50'F and 104*F by the MAB HVAC system.

Each SI train contains a high head safety injection (HHSI) and low head safety injection (LHS!) pump.

Each HHS! pump has a design flow rate of 800 gpm at a head of 2850 f t., a maximum flow rate of 1600 gpm, and a shutof f head of 3900 ft.

Each LHS! pump has a design flow rate of 1900 gpm at a head of 560 ft., a maximum flow rate of 2900 gpm, and a shutoff head of 700 ft.

Each pump is provided with a minimum flow bypass line with two redundant valves in series returning pump discharge flow to the RWST to prevent pump deadheading.

The system is aligned so that in the event of a SI signal, the pumps automatically take suction from the RWST.

When the RWST low-low level is reached, the system is automatically switched to the recirculation mode as described in Section 6.3.2.

07/12/85 62 SOUTH TEXAS SER SEC 15

i l

o 1

The NHSI pumps discharge directly to the cold legs.

The LHSI pumps discharge to the cold legs via the RHR heat exchangers for decay heat removal during the i

i i

design base LOCA recirculation phase.

The system design makes no provisions 1

for decay heat removal by the RHR heat exchangers when the RCS pressure is i

higher than the LHS! pump shutoff head.

The FSAR states that after approxi-l mately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> the operator manually realigns the system for hot leg recircu-I lation to prevent boron precipitation in the reactor vessel.

r The SI and containment spray pumps are located in 3 pump rooms, one for each train, located in the lower level of the fuel handling butiding.

The applicant

)

i

{

states that no external $1 pump cooling is required, as the seals and bearings I

I are cooled by the pumped fluid.

Pump testing is discussed in Section 6.3.4.3.

i l

The accumulators are partially filled with borated water.

Based on the assump-

[

i i

l tions made in the LOCA analysis, the water volume in each accumulator must be l

1 e

)

1580 ft3 (informal submittal).

FSAR Table 6.3-1 lists a normal water volume of l

1 f

2 i

1200 ft.

This must be corrected.

The accumulators are pressurized with l

1 j

nitrogen.

Fluid level, baron concentration and Na pressure can be remotely

[

adjustedduringnormalplantoperation.

Each accumulator is isolated from the

{

]

i RCS by two check valves in series.

In the event of RCS depressurization below d

1 j

the accumulator pressure, the accumulator contents are forced into the RCS.

A l

t l

normallyopenmotoroperatedvalveintheaccumulatordischargelinehas,th

(

l i

electric power source removed from the valve motor durina normal operation, t

b l

i

)

The STP ECCS is designed such that a minimum of two accumulators delivering to h

r j

two intact loops, and one high head and one low head safety injection pump I

delivering to an intact loop will assure adequate core cooling in the event of r

i j

07/12/85 6-3 SOUTH TEXAS SER SEC 15 I

U

[

j the design basis LOCA.

The system is designed to provide the required heat i

i j

removal capability with a single active failure in the short term and a single l

I active or passive failure in the long term.

The system can function adequately l

in the event of LOOP, assuming a single failure in the emergency power system j

such as the failure of one diesel generator.

As described in section 6.3.5, I

the appitcant analyzed both "no failure" and " single failure" cases for the j

large break LOCA.

l t

The ECCS is initiated on O( a SI signal, which is actuated on (1) low J

i pressurizer pressure (2) Hi-1 containment pressure, (3) low compensated steam

]

line pressure, (4) low-low compensated T cold laterlocked with P-15 (i.e., less j

than 10% power), (5) manual actuation from the control room.

Adequate jl monitoring of the accident can also be performed from the control room.

These i

[

j meet the requirements of GOC 19 and 20.

The evaluation of the adequacy of r

l instrumentation for monitoring and controlling the ECCS to maintain adequate

[

core cooling following a LOCA or other accident is found in SER Section 7.5.

i l

t Actuation of the SI signal automatically initiates operation of the HHS! and LHS! pumps, opens the $! pump miniflow isolation valves and any closed accumu-1 lator isolation valves.

The standby diesel generators, component cooling water I

}

I flow to the RHR heat exchangers, HVAC equipment and other compone:nts required i

to support ECCS operation are also actuated by the SI signal.

Three separate and redundant engineered safet'y features actuation systems (ESFAS) are J

l i

provided.

I The applicant has performed not positive suction head (NPSH) calculations for i

the SI pumps during the ECCS recirculation phase, assuming maximum expected i

i 07/12/85 64 SOUTH TEXAS SER SEC 15 i

i.

l

b pump fluid temperature and no increase in containment pressure.

The results of these calculations were included in responses to staff inquiries and indicate that the NPSH is adequate. We conclude that the STP design meets the intent of

[

Regulatory Guide 1.1 with respect to ECCS pumps.

However, in an informal submittal to the staff, dated August 23, 1985, the applicant indicates that the STP design does not meet sump minimum submergences, maximum Froude number and maximum pipe velocity criterion contained in NRC Regulatory Guide 1.82, Proposed Revision 1, May 1983.

The submittal also proposes installation of

)

vortex breakers and requests that STP not be required to perform ECCS sump tests.

The evaluation of the adequacy of the containment sump design with regard to prevention of debris accumulation, unacceptable vortex formation, the need for ECCS sump tests and other pertinent features is contained in SER i

l Section 6.2.

ThevalvearrangementontheECCSdischargeIIneshasbeenreviewedwith f

3 l

1 l

respect to determining adequate isolation between the RCS and the low-pressure j

ECCS.

In some lines, this isolation is provided by two check valves in series

]

with a normally closed isolation valve (high head injection discharge and low head injection discharge to the hot legs).

Other discharge lines have only two i

check valves in series.

The applicant has stated that test lines are provided for periodic leakage checks of reactor coolant past the check valves forming the reactor coolant system pressure boundaries and that these valves will be l

classified as ASME IW-2000 Category AC.

This isolation capability is acceptable.

The frequency of the leak testing is evaluated in Section 3.9 of this SER.

i The system is designed such that during normal operation the ECCS lines will be maintained in a filled condition by the head of the RWST.

High point vents are 07/12/85 6-5 SOUTH TEXAS SER SEC 15

provided.

Maintaining these lines in a filled condition will minimize the likelihood of water hammer during system startup.

No ECCS components are shared between units.

This meets GOC 5.

6.3.2 Evaluation of Single Failure The staff has reviewed the system description and piping and instrumentation diagrams to verify that sufficient core cooling will be provided during the initial injection phase with and without the availability of offsite power, assuming a single active failure.

The accumulators have normally open motor-operated isolation valves in the discharge lines.

The applicant has stated in FSAR Section 6.3 that those valves whose spurious movement could result in degraded ECCS performance, including the accumulator isolation valves and hot leg isolation valves, have power lock-out capability.

During startup, the accumulator isolation valves are placed in the position necessary to mitigate the consequences of a LOCA (open) and then have the power removed.

The ECCS is a three train system that is fully redundant except for the water source for the injection phase.

There are no single active failures that can prevent the ECCS from taking suction from this source.

The applicant states in FSAR Section 6.3 that each train of the ECCS is powered by an independent emergency bus.

Each emergency bus can be powered from a separate diesel gener-ator in the event nf loss of offsite power, as required by GDC 17.

At least two trains would be operable in the event of loss of offsite power and failure of one diesel generator.

Both high and low-head injection systems are normally aligned so that valve actuation ia not required during the injection phase.

07/12/85 6-6 SOUTH TEXAS SER SEC 15 l

The engineered safety features actuation system (ESFAS) is designed to auto-matically perform the short-term injection phase and initiate long term recir-culation.

No operator actions are required for SI initiation.

Three separate and redundant actuation trains are provided.

Each actuation train is assigned to a corresponding electrical power train to ensure that, in the event of a single failure in the actuation logic, at least two emergency diesel generators, two HHSI and two LHSI pumps would receive an actuation signal.

There are also provisions for manual actuation and monitoring of the ECCS on the main control board.

This complies with SRP 6.3 and is acceptable.

1 The applicant has proposed an automatic system to initiate switchover of the low head system from the injection to the recirculation mode.

Operator action will be required to complete this switchover.

Logic is provided to automatically open the containment sump isolation valves on low-low level in

[

the Refueling Water Storage Tank (RWST) so as to provide a source of water to the RHR pumps, and isolate the SI miniflow lines.

Backflow to the RWST is j

prevented by a check valve.

To prevent backflow leakage across the check valve, the operator remotely isolates three motor operated RWST discharge valves.

The applicant, in response to a staff inquiry, provided check valve 1

generic failure data which indicate a Icw likelihood of gross leakage due to 4

the valve sticking open.

For minor seat leakage, the staff concludes that the preferred flow path would be from the sumps to SI pump suction.

l Based on its review of the design features, the staff concludes that the ECCS complies with the single-failure and isolation criteria of GOC 35.

l 07/12/85 6-7 SOUTH TEXAS SER SEC 15

,--,-..n,

6.3.3 Qualification of Emergency Core Cooling System The ECCS design to seismic Category I criteria, in compliance with RG 1.29'is discussed in Section 3.2 of this SER.

The location of ECCS components in structures designed to withstand a safe-shutdown earthquake and other natural phenomena, per the criteria of GDC 2, is also discussed in Section 3.2, 3.3 and 3.4.

The ECCS protection against missile: inside and outside containment by the design of suitable reinforced concrete barriers, which include reinforced con-crete walls and slabs (conformance to GDC 4), is discussed in Section 3.5 of this SER. The protection of the ECCS from pipe whip insida and outside of containment is discussed in Section 3.6 of this SER.

The active components of the ECCS designed to function under the most severe duty loads, including safe-shutdown earthquake,'are discussed in Sections 3.9 and 3.10 of this SER.

The ECCS design to permit periodic inspection in accor-dance with ASME Code,Section XI, which constitutes compliance with GDC 36, is discussed in Section 6.6 of this SER.

As noted in SER Section 5.4.7, the ECCS utilizes the RHR heat exchangers and associated valves and piping for long term decay heat removal.

The FSAR states that the ECCS motor operated valves will be located above the maximum calculated post-accident water level.

Additional information on ECCS equipment post-accident environmental qualification will be submitted at a later time, and will be evaluated in SER Section 3.11.

Our concerns regarding l

i 07/12/85 6-8 SOUTH TEXAS SER SEC 15

< ~,

i post-accident environmental qualification of RHR components are included in SER Section 5.4.7.

During the 1 cog term recirculation phase, leak detection is required to identify passive ECCS failures outside containment, such as pump seal failures.

The applicant has provided class 1E, seismic Category I level detectors in the SI pump rooms.

The applicant indicates that the equipment has been located such that the Ifmiting leak (assumed to be 50 gpm due to a pump shaft seal failure) would be detected and isolated withia a period of time compatible with operator action time.

Protection against internal and external flooding is further evaluated in SER Section 9.3.3.

6.3.4 Testing The applicant has committed to demonstrate the operability of the ECCS by sub-jecting the ECCSsto p eoperational and periodic testing.

The applicant has committed to meeting the intent of RG 1.79, "Preoperational Testing of Emergency Core Cooling System for Pressurized Water Reactors" for the ECCS.

A program has been established for periodic testing that demonstrates compliance with GDC 37.

6.3.4.1 Preoperational Testing Tests will be conducted to verify proper startup. With the ECCS aligned for normal power operation a SI signal would be simulated and the breakers supply-ing offsite power tripped.

Proper operation the SI signal generation and transmission, proper startup of the diesel generators including sequential load 07/12/85 6-9 SOUTH TEXAS SER SEC 15

pickup, valve operating times, pump starting times, and delivery rates at pump runout conditions would be established.

Proper operation of the accumulators would be demonstrated.

The FSAR states that the ECCS preoperational test pro--

gram would be performed in accordance with RG 1.79 with exception of "in situ" emergency sump recirculation testing.

The emergency sump design would be eval-uated in accordance with the proposed revision to RG 1.82, Appendix A, to verify vortex control and acceptable pressure drops across screens, valves and piping.

This is evaluated in SER Section 6.2.

6.3.4.2 Periodic Component Tests i

Routine periodic testing of the ECCS components and all necessary support systems at power will be performed.

All ECCS components can be tested online

'or have power locked out.

Valves that actuate after a LOCA are operated i

through a complete cycle.

Pumps are operated individually in this test on their mini flow lines.

Series check valves that form a pressure boundary are supplied with test lines to perform leak tests.

A visual inspection of pump seals, valve packings, flange connections and relief valves will be made in l

order to detect leakage.

Accumulator performance will be monitored by level and pressure instrumentation during plant operation.

STP will have the capability to conduct an integrated test when the plant is cooled down and RHR l

is operating. This integrated test will demonstrate operability of the valves,

)

i pump circuit breakers and automatic circuitry, including the starting and loading of the diesel generators.

The applicant has stated that the ECCS ccm-ponents and systems are designed to meet the intent of ASME Code,Section XI.

i 07/12/85 6-10 SOUTH TEXAS SER SEC 15

o 6.3.4.3 SI Pump Testing With regard to SI pump performance testing, the applicant's response to RSB question 211.31 (Amendment 26) indicated that a series of tests were performed, including subjecting the pump to a thermal transient at runout flow together with injection of particulate matter; a 100 hour0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> endurance test at design speed, performed at minimum, design and runout flow; and 4 start-stop cycles.

Measurements taken during the test included vibration, hydraulic performance and seal leakage.

Critical part dimensions were measured before and after each test.

The pump experienced no performance degradation and no unusual or excessive wear.

The applicant also informally submitted seal test data, which indicated that without external cooling, seal life for operation under the most adverse conditions (350*F, 400 psig) may be as low as 500 hours0.00579 days <br />0.139 hours <br />8.267196e-4 weeks <br />1.9025e-4 months <br /> but under more normal conditions seal life should be at least one year. The staff concludes that the SI pump tests were adequate.

6.3.5 Performance Evaluation The ECCS is designed to deliver fluid to the RCS to limit the maximum fuel cladding temperature following transients and accidents that require ECCS actuation.

The ECCS is also designed to remove the decay and sensible heat during the LOCA recirculation mode.

10 CFR 50.46 lists the ECCS acceptance criteria for the design base LOCA.

These criteria include the following:

(1) The calculated maximum fuel cladding temperature shall not exceed 2200'F.

07/12/85 6-11 SOUTH TEXAS SER SEC 15

(2) The calculated total oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

(3) The calculated total: amount of hydrogen generated from the chemical re-action of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the cladding cylinders surrounding the fuel, excluding the cladding sur-rounding the plenum volume, were to react.

(4) Calculated changes in core geometry shall be such that the core remains amenable to cooling.

(5) After any calculated successful initial operation of the ECCS, the cal-culated core temperature shall be maint'ined at an acceptably low value a

and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core.

In addition, 10 CFR 50.46 states ECCS cooling performance shall be calculated in accordance with an accept-able model, and shall be calculated for a number of postulated loss-of-coolant accidents of different sizes, locations and other properties sufficient to provide assurance that the entire spectrum of postulated LOCAs is covered.

Appendix K to 10 CFR 50, ECCS Evaluation Models, sets forth certain required and acceptable features of evaluation models.

I 07/12/85 6-12 SOUTH TEXAS SER SEC 15

6.3.5.1 Large-Break LOCA The applicant has examined a spectrum of large breaks in RCS piping, and these analyses indicate that the most limiting event is a cold-leg double-ended guil-lotine break with a Moody discharge coefficient of 0.6.

(Informal submittal)

The applicant performed calculations assuming both operation of three trains and two trains of active ECCS components and three accumulators, with the con-tents of one active and one passive train spilling to containment.

Maximum peak clad temperature (1981*F) resulted from three train operation.

(Note:

This information was' submitted informally.

The FSAR must be revised accord-ingly).

ECCS was assumed to be initiated by low pressurizer pressure.

The analysis results demonstrated that adequate core cooling is provided assuming the worst single failure, with no credit taken for nonsafety grade equipment.

The applicant states that the large break LOCA analysis was performed with the approved December 1981 version of the evaluation model (WCAP 8471).

The BART code utilized is described in WCAP 9561, which has been approved by NRC.

Concerns expressed in NUREG-0630 about the conservatism of fuel-cladding swel-ling and rupture have been incorporated in the BART code and are addressed in WCAP 9561.

The analysis assumes an initial power of 102%.

Containment parameters are chosen to minimize containment pressure so that core reflood calculations are conservative.

Fuel rod initial conditions are chosen to maximize clad temperature and oxidation.

The most limiting break with respect to peak clad temperature (PCT) is the double-ended cold leg guillotine break, with maximum safety injection (i.e., three SI trains operating) and with a discharge 07/12/85 6-13 SOUTH TEXAS SER SEC 15

)

0 o

coefficient (C ) = 0.6. The PCT is 1981*F* which is below the 2200 F limit of D

10 CFR Part 50.46.

The maximum calculated local and core-wide clad metal-water reaction values were 4.24%* and less than 0.3%, respectively.

These values are within the 17% and 1% limits of 10 CFR Part 50.46, respectively.

Discharge coefficients of 0.4, 0.6 and 0.8 were considered.

In the previous STP analyses (prior to using BART), the highest PCT was achieved with a C f 1.0.

Also, D

Appendix K of 10 CFR Part 50 requires that at least three values of discharge coefficients be considered that span the range of 0.6 to 1.0.

The applicant should provide confirmatory analyses for the case CD = 1.0 using the BART code or provide a justification that shows this case to be bounded by the other discharge coefficients.

The applicant should also formally submit the new LOCA analysis.

In the LOCA analysis, an upper head temperature equal to the hot leg temperature was conservatively assumed.

The applicant has analyzed the performance of the ECCS for the large break LOCA in accordance with the criteria set forth in 10'CFR 50.46 and Appendix K to 10 CFR 50. The staff has reviewed the applicant's evaluation, and concludes that it'is acceptable with the possible exception of the range of discharge coefficients used in the analysis.

6.3.5.2 Small-Break LOCA The applicant has submitted results for a spectrum of small-break LOCA analyses (3 in., 4 in., 6 in.), performed for the initial 1500 seconds of the event.

These identify that the 4 in. break is the limiting small break in terms of Informal submittal 07/12/85 6-14 SOUTH TEXAS SER SEC 15 l

l

calculated PCT (1201.2 F), and local zirconium-water reaction (0.08%).

The staff has requested that the applicant demonstrate the adequacy of the STP ECCS for long-term decay heat removal in the event of a small break LOCA of a size such that recirculation would be required but the RCS pressure either re-mains above the LHSI pump shutoff head or recovers after loss of the secondary 1

heat sink. The STP ECCS is not designed for high head recirculation combined with RHR heat exchanger decay heat removal.

Also, as noted in Section 5.4.7, the steam generators presently have a limited supply of safety grade secondary water supply.

The applicant verbally indicated to NRC that based on preliminary estimates, for small break LOCAs the combined heat sink capacity of the RWST and steam generators would provide core cooling for about 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />, after which the reactor containment fan coolers (RCFCs) would provide an adequate heat sink for decay heat removal.

We requested that the applicant provide a detailed explanation of the mechanism of energy removal from the RCS after loss of the secondary heat sink and supporting analyses that energy can be adequately removed and sufficient RCS inventory maintained to meet the criteria of 10 CFR Part 50.46. We are particularly concerned that for very small break LOCAs (e.g., 1 inch) energy would not be adequately removed from the break until some later period (e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

The applicant has not yet l

responded to this inquiry. We will report the results of our findings in a l

future supplement to the SER.

l 1

l 07/12/85 6-15 SOUTH TEXAS SER SEC 15

i 6.3.5.3 LOCA During Shutdown In response to staff question 211.32, (Amendment 29) requesting description of alarms available to alert the operator to a failure in the primary or secondary system during startup or shutdown and justification of the time available for manual operator actions to initiate mitigative systems, the applicant provided large and small break LOCA analyses during shutdown.

Startup analyses were not provided since shutdown is more limiting due to higher core decay heat generation.

During shutdown, the SI low RCS pressure actuation signal is manually blocked at 1900 psi. Other SI actuation signals including containment high pressure, and manual actuation, are still available.

At 1000 psi and 425'F the accumulator discharge valves are closed and locked out, and the HHSI pumps are locked out. At 400 psi and 350 F the RHRS is aligned for cooldown.

As noted in the response, the effects of a large cold leg break LOCA would be less severe during shutdown than at power,,since the~ decay heat and RCS stored energy would be less.

The applicant also states that the probability for occurrence of a large break LOCA would be less at low pressure, particularly below 1000 psi.

The analysis was performed at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after shutdown, 1000 psi and 425"F. The LHSI pumps are actuated on high containment pressure.

Maximum PCT was calculated as 2055.8*F, which meets 10 CFR Part 50.46 criteria.

'However, the applicant utilized CD = 1.0.

Recent LOCA analyses indicate maximum PCT occurring at CD = 0.6.

The staff requires either a reanalysis with a range of C 's, or otherwise justify why a CD = 1.0 is the limiting case, D

l l

07/12/85 6-16 SOUTH TEXAS SER SEC 15 l

utilizing approved codes and methods, and assuming the most severe single failure.

Small break LOCA analyses were also performed at 400*F and 1000 psig.

For 6 in. and 8 in, breaks, the Hi-1 containment signal would occur respectively at 5 and 2.5 minutes.

LHSI pump actuation at 10 minutes for the 8 in. break and 18 minutes for the 6 in. break (when RCS pressure drops below the LHSI pump shutoff head) prevents core uncovery.

For the 4 in. break, the core remains covered with the LHSI pump activated in 10 minutes and one HHSI pump activated in 30 minutes.

For 2 in, and smaller breaks, the containment pressure does not reach the Hi-1 signal setpoint.

The containment high radiation alarm and sump high level i

alarm would be available.

The applicant indicates that for a 2 in. break the high radiation alarm would sound within 30 minutes of break initiation, and core uncovery without operator action would occur at 1.67 hours7.75463e-4 days <br />0.0186 hours <br />1.107804e-4 weeks <br />2.54935e-5 months <br />, thus providing ample time for corrective action.

However, similar analyses for another Westinghouse plant indicated that following break occurrence, core uncovery would start in 10 minutes with no operator action. Therefore, the staff requests that the applicant provide a confirmatory justification regarding the validity of the analysis results.

6.3.6 Conclusions The ECCS includes the piping, valves, pumps, heat exchangers, instrumentation, and controls used to transfer heat from the core after a LOCA.

The scope of review of the STP ECCS included piping and instrumentation diagrams, equipment 07/12/85 6-17 SOUTH TEXAS SER SEC 15

i m

\\

layout, failure modes and effects analyses, and design specifications for essential components.

The review included the applicant's proposed design criteria and design bases for the ECCS and the manner in which the design conforms to these criteria and bases.

The staff review of the failure modes L

and effects analyses found these analyses accpetable.

The staff concludes that the design of the ECCS is acceptable and meets the re-quirements of GC0 2, 5, 17, 27, 35, 36, and 37, except as noted.

This conclusion is based on the following:

(1) The applicant has met the criteria of GOC 2 with regard to the seismic design of the ECCS and the structures housing it, and also of nonsafety i

systems or portions thereof that could have an adverse effect on ECCS by meeting Position C.2 of RG 1.29.

This is further discussed in SER Section 3.2.

t (2) The applicant has met the criteria of GDC 5 with respect to sharing of structures, systems, and components by demonstrating that the ECCS and ancillary systems are not shared between STP Units 1 and 2.

l (3) The applicant has met the criteria of GDC 17 with respect to providing sufficient capacity and capability to ensure that the core is cooled and vital functions are maintained in the event of postulated accidents, with and without the availability of offsite power.

(4) The applicant has met the criteria of GDC 27 with regard to providing com-bined reactivity control system capability in conjunction with poison 07/12/85 6-18 SOUTH TEXAS SER SEC 15 l

.u added by the ECCS to ensure that under postulated accident conditions and with appropriate margin for stuck rods, the capability to coel the core is maintained.

(5) The applicant has met the criteria of GOC 35 in regard to abundant core cooling capability for ECCS by providing redundant safety grade systems to transfer heat from the core at a rate so that fuel and clad damage that could interfere with effective core cooling is prevented, and clad: metal-water reaction is limited to negligible amounts, providing the applicant supplies the additional information listed at the end of this section.

(Item 8)

(6) The applicant has met the criteria of GDC 36 with respect to the design of ECCS to permit appropriate periodic inspection of important components of the system.

(7) The applicant has met the criteria of GDC 37 with respect to designing the ECCS to permit testing of the operability of the system throughout the life of the plant, including the full operational sequence that brings the system into operation.

The plant Technical Specifications will need to be reviewed to confirm compliance to the criteria.

(8) The applicant has provided an analysis of the ECCS performance using an approved analysis model that meets the criteria of Appendix K to 10 CFR 50 and has shown the system performance meets the acceptance criteria of 10 CFR 50.46 with the exception that a large break LOCA must be evaluated with a discharge coefficient of 1.0 or provide justification that this E

07/12/85 6-19 SOUTH TEXAS SER SEC 15

o 1

case is bounded by the other calculations.

A new long-term analysis for small break LOCAs must be provided.

The applicant must provide confirmation that the assumptions utilized for available time for operator action in the event of a very small LOCA during shutdown are valid, and 1

i that the discharge coefficient and codes used in the large break LOCA analysis during shutdown are valid.

As noted in Section 5.4.7, the RHRS presently does not appear to conform with 4

the long-term cooldown requirements of 10 CFR Part 50.46 since the RHR pump and certain valve motors are not qualified for the post-accident environments.

We i

will provide our evaluation of the above open and confirmatory items in a SER supplement.

4 S

0 07/12/85 6-20 SOUTH TEXAS SER SEC 15 l

4 e

8.0 ELECTRIC POWER 8.1 Introduction i

Tira FSAR Chapter 8 provides design information and description pertaining to offsite and onsite electric power systems at South Texas Nuclear Power Plant.

The staff review was to assure that the design is in compliance with all the applicable regulations listed and explained in the Appendix A to 10 CFR Part 50 for both offsite and onsite electric power systems.

Further to this, the i

onsite power system was reviewed to ensure that given a loss of the offsite power system and a single failure in the onsite power system, sufficient power will be available for mitigating the consequences of a design basis event.

8.1.1 Acceptance Criteria SRP Table 8.1, " Acceptance Criteria and Guidelines for Electric Power Systems" lists various applicable GDCs (General Design Criterion) from Appendix A to 10 CFR Part 50, regulatory guides, branch technical positions, NUREG reports and Institute of Electrical and Electronics Engineers (IEEE) standards. The primary criteria from the ones listed in Table 8-1 are GDC 2, 4, 5, 17, 18 and 50; Regulatory Guides. l.6,1.9.1.32,1.63,1.75,1.128 and the IEEE standards endorsed by these regulatory guides *. The staff has determined that conformance to and im'blementation of the applicable guidelines of the GDC and regulatory guides in the design and installation provides sufficient basis for acceptance and assurance that the electric power systems will perform their design safety functions when' required. The staff evaluation of the offsite and onsite SOUTH TEXAS SER 8-1 b

e,,

,.n

!l' i

l electric power systems design and its conformance to the requirements of the 1

l listed criteria are provided in the following sections.

In addition to this j

t j

evaluation the staff will visit the site to view installation of the electrical i

equipment and cables, to review confirmatory electrical drawings, documents and l

test results to assure that the design criteria are properly implemented. The j

confirmatory site visit will be completed before the license is issued, and if, l

any deviations from the design requirements are noted, it will be addressed in a supplement to this report.

I b

j The staff conclusions in each of the following sections are subject to accept-able implementation of any design changes that may be required as a result of I.

the staff's site visit.

i i

l 8.2.

Offsite Power System i

)

8.2.1 General Description l

The offsite power system provides preferred source of power to ' safety-related j

and important to safety electric equipment. This system should have a minimum of two independent circuits to the onsite distribution system from the trans-mission network with an allowed common switchyard. These two circuits include l

transmission lines to the switchyard, switchyard components, transformers,

{

cables, control circuitry and other associated components from the utility grid

[

to the supply side of the onsite power distribution system. The safety func-tion of the offsite power system (assuming that the onsite power system is not l

functioning) is to provide sufficient capacity and capability to ensure that

{

the structures, systems and components, safety-related and important to safety, perform their safety function as intended. The objective of the staff review istodetermineiftheoffsitepowersystemdesign(1)complieswiththe 3

l requirements of the criteria provided in Section 8.1.1 of this report and (2)

]

provides assurance for a reliable performance of its design function during j

plant cperation and accident conditions.

I l

SOUTH TEXAS SER 8-2

1 o

l i

l i

j The South Texas Project (STP) is a two unit nuclear power station with a 345 kV switchyard. Eight 345 kV transmission circuits rated from 850 to 1080 MVA j

connect the switchyard to the grid.

In addition to the eight 345 kV transmis-j sion circuits there will be a connection, rated 1080 MVA, from the switchyard j

at the STP to a high voltage direct current (HVOC) interconnection system j

estimated to be in operation by December 1985. These circuits provide the source of preferred power to the station through the STP switchyard and the i

station standby and unit auxiliary transformers. Three rights-of-way commence

{

from the STP property to the termination points of the grid, namely eastern, western, and middle rights-of-way. The eastern and western right-of-ways are I

each 100 ft. wide and respectively contain two and one 345 kV circuits. The middle right-of-way is 400 ft. wide and contains the remaining five of the j

eight 345 kV circuits. These circuits are carried on three sets of double-j circuit towers. There is adequate spacing between these sets of towers to j

allow complete failure of one without jeopardizing the other. Steady state j

and transient stability studies demonstrate that the loss of both units at the STP or the loss of one unit with the other unit on-line or off-line does not

)

impair the ability of the offsite power system to supply adequate preferred power to the ESF electrical system. These studies further demonstrate that I

the loss of any double circuit structure or any two transmission circuits or the loss of any single independent right-of-way does not reduce the capability f

of the offsite power systems to perform its safety function.

The STP switchyard is arranged in a breaker-and-a-half scheme in two buses l

(north and south) configuration. Each of the two buses have connected to it a l

150 MVA shunt reactor through a 2000 amp circuit switcher. All 345 kV breakers i

have a maximum symetrical interrupting capability of 40,000 amp and a 40 gva i

fault duty design. The breaker-and-a-half scheme in the switchyard provides J

the following operating flexibility.

1.

Any transmission line into the switchyard can be cleared either under f

normal or fault conditions without affecting any other transmission line or bus.

SOUTH TEXAS SER 8-3 I

2.

Either bus can be cleared under normal or fault conditions without inter-ruption of any transmission line or the other bus.

3.

Any circuit breaker can be isolated for maintenance or inspection without interruption of any transmission line _or bus.

4.

A fault in a tie breaker or failure of the breaker to trip for a line or generator fault results only in the loss of its two adjacent circuits until it can be isolated by disconnect switches.

5.

A fault in a bus side breaker or a failure of the breaker to trip for a line or generator fault results only in the loss of the adjacent circuit i

and the adjacent bus.

A primary and a secondary protective relaying system is provided on each transmission line, buses and circuits connected to the 345 kV switchyard.

In addition to this, each circuit breaker in the switchyard has an associated relaying scheme for initiating local tripping of adjacent circuit breakers in I

case of a breaker failure to protect other circuits affected by this failure.

Both primary and secondary relaying schemes initiate protective actions in i

separate trip circuits of a 345 kV switchyard circuit breaker. Current and voltage input to both primary and secondary protective relaying for each of the above circuits are respectively provided by separate sets of current trans-formers and voltage devices. The control power for both primary and secondary I

protective relaying schemes are provided by two separate 125V de system allo-cated exclusively to the switchyard. Each 125V de system consists of a ba't-l tery, a battery charger and 125V de distribution panel board. These two dc systems are connected by a normally open tie breaker and are entirely indepen-dent of the unit Class IE and non-Class IE battery systems. Each battery charger is connected to a panel board located in the STP 345 kV switchyard control house.

l SOUTH TEXAS SER 8-4

t The control and relaying cables for the switchyard breakers are auted in three l

parallel, independent cable trenches. The two outer trenches carry the primary relaying and control cables for all switchyard circuit breakers. The center trench carries the secondary (backup) relaying and control for all circuit breakers. Cables are routed from each circuit breaker to the respective trenches in such a fashion as to maintain separation between primary and secondary relaying and control circuits.

The offsite power from the utility grid and STP switchyard is supplied to the unit's onsite distribution system (ESF buses) through the respective unit auxiliary transformer, the plant standby transformers no. I and 2, three inter-mediate 13.8 kV standby buses and three ESF 13.8 kV/4.16 kV transformers.

Each standby transformer has the capacity to supply all ESF loads of both units and two 13.8 kV auxiliary buses. These two standby transformers are shared between the two units and are the two preferred power sources to each unit.

j In addition to the two standby transformers, there is a 138 kV/13.8 kV emergen-cy transformer connected to a 138 kV transmission line which is independent of the 345 kV transmission circuits and the STP switchyard. This circuit has capability to be a source of offsite power to one of the three ESF buses in both units at one time. This circuit can be manually connected in case when immediate and delayed sources and the onsite diesel generator sources are all out of service. The normal BOP buses do not have access to the emergency transformer.

l l

The separation between the two standby transformer circuits (the two offsite l

power sources) and the emergency transformer circuit (additional offsite power source) to mair.tain their independence from each other is achieved by the following design features.

1.

The high-voltage circuits of each standby transformer are routed on separate steel structures and terminated on separate buses in the 345 kV SOUTH TEXAS SER 8-5

switchyard. The north bus is extended so the no. 1 standby transformer leads do not cross over the south bus.

2.

The location of the steel structure for the 138 kV line to the emergency transformer and the 345 kV lines from the switchyard to the standby transformers 1 and 2 are so arranged that a complete failure of the structure serving one of the transformers will not jeopardize the integri-ty of the structure or the associated high voltage leads serving the other two transformers.

3.

The no. I and no. 2 standby transformers and the emergency transformer are physically separated from each other to prevent a single accident of one transformer (e.g., fire) from jeopardizing the operation of the other transfo rmer.

4.

The 138 kV transmission line does not cross any high-voltage lead from the 345 kV switchyard to the plant.

Each of the three transformers is protected by their primary and backup relays.

The centrol power for the protective relaying system of the standby transform-ers 1 and 2 is provided from the respective unit's non-Class 1E 125V dc system and for that of the emergency transformar, it is provided by a branch circuit from the 125V de system of 345 kV STP switchyard. The switchyard bus voltages, breakers status and battery conditions are indicated and/or alarmed at the control room and HL&P energy control center. Transfer from one offsite source of power to the other is essentially manual initiated from the control room.

A breaker and-a-half arrangement and redundant relaying of the switchyard, transmission lines and the transformers, fdcilitates periodic testing of the 1

offsite power system, its protective relaying components and the 125V dc control power system during plant operation. The generator breaker is routine-ly tested during plant shutdown.

i SOUTH TEXAS SER 8-6

8.2.2 Grid Analysis The eight 345 kV transmission lines to STP switchyard and the 138 kV line to emergency transformer are interconnected to five electric utilities, composed of bulk power and distribution systems called South Texas Interconnected Systems (STIS). These utilities, together with several other distribution systems, form what is called Electric Reliability Council of Texas (ERCOT).

The applicant's steady state (load flow) and transient stability analysis using criteria shown in Table 8.2.3 of the FSAR and the results shown on Figures 8.2-6 through 8.2-12 demonstrate that outages of critical generators, faulting of critical buses or overloaded transmission circuits will not endanger the supply of offsite power to the ESF electrical sistems.

The maximum frequency decay was found to be of 59.5 HZ and of such short duration that it will not cause any damage to the motors. These results also substantiated that at STP, the maximum credible grid frequency dech rate is less than the assumed maximum decay rate of 5 HZ/sec by Westinghouse in their analysis of fuel damage caused by low flow due to grid frequency decay, without tripping of reactor coolant pump breakers.

8.2.3 Conclusion Based on the evaluation in Section 8.2.1 and 8.2.2 of this report, the staff has concluded that the design of the offsite power system for South Texas power nuclear Units 1 and 2 meets the requirements of GDC 5,17 and 18 of the Appendix A to 10 CFR Part 50 and is, therefore, acceptable.

8.3 Onsite Power System 8.3.1 AC Power System The onsite ac power system is a Class 1E system and is designed to perform as a standby source of ac power in case the offsite (preferred source) power is not i

SOUTH TEXAS SER 8-7

available. The safety function of the onsite power system (assuming the off-site power system is not operative) is to provide sufficient capacity ard capability to ensure that the structures, systems and components important to safety perform their safety functions as designed. The objective of the staff review was to detemine if the onsite ac power system is designed to have the l

required redundancy, meets the single failure criterion, can be tested and is capable of independently supplying reliable power to all required safety loads.

The acceptance criteria was to detemine if the onsite ac power systems are designed in accordance with the criteria identified in Section 8.1.1 of this report.

The STP standby ac power system is an independent onsite power system designed to automatically start on a safety injection and/or loss of offsite power signal and provide adequate power to the Class 1E loads to ensure safe shutdown of the plant when the offsite source of power is not available. This system is designed to provide ac power to all Class IE electrical loads and some selected non-Class IE loads.

At STP, the onsite ac power system consists of three independent divisions of safety-related distribution systems. Two divisions out of the three are necessary to mitigate the consequences of a design basis accident. The design meets the single failure criterion as failure of any one of the three divisions will not jeopardize the safety function of the onsite ac power system. Each division consists of a 4160 volt bus supplied from its independent 13.8 kV/4.16 kV ESF transformer and diesel generator and 480 volt load centers and motor control centers. The diesel generators (onsite ac source) are independent of the ESF transformers supplying offsite power.

The normal power supply to each of the three divisions is from its own ESF transformer which can manually be connected to any one of the four sources of offsite ac power as described in section 8.2 of this report. During nomal operation one of the three ESF transfomers is connected to the unit auxiliary transformer while the remaining two are connected to the unit's standby trans-former. On generator trip, the generator breaker opens and provides immediate SOUTH TEXAS SER 8-8

I i

access offsite power source to the one ESF transformer which is normally connected to the unit auxiliary transformer.

In case the generator breaker fails to open causing the switchyard breaker to trip, the power to the unit auxiliary transformer will be lost and hence to the one ESF transformer con-nected to it. This will cause the respective diesel generator to start on loss of voltage and provide ac power to the affected division. This will not affect the other two divisions as they continue to be supplied from the unit's standby transformer which is not affected by the generator trip. The second offsite power source to the ESF buses can be manually restored, as a delayed source of power. This source of pcwer can be restored to all ESF buses from the other unit's standby transformer or the unit's auxiliary transformer through the main step-up transformer.- The third delayed source of power to one of the three ESF trains in each unit can be restored from the emergency transformer as the last available source of offsite ac power.

All ESF motors of ratings greater than 300 HP are supplied from 4160 volt bus, 150 to 300 HP motors are supplied frcm 480 volt load centers and motors of less than 150 HP are supplied from 480 volt MCCs. All these motors are suit-able for running at 10% of their nominal voltage rating. All 4.0 kV motors have a service factor ranging from 1.0 to 1.15, whereas generally all 460 volt motors have a service factor of 1.15. All Class IE motors are seismically and environ:rentally qualified. Trouble alarms in the control room are provided for the ESF motors. Transformer impedances and standby diesel generator voltage regulator and exciter characteristics are selected to permit starting the i

largest motor on a particular bus, while all other loads connected to the bus are already energized. This will not cause the voltage at the terminals of ESF motors to fall below 80% of their nominal voltage rating. The applicant has committed to submit the onsite distribution system voltage analysis and the verification test results following the guidelines of BTP PSB-1 to confirm j

these design features. The staff will provide its evaluation of the analysis and test results in a supplement to this report, l

i l

l l

l I

SOUTH TEXAS SER 8-9

l i

The onsite standby power systems of Unit I and 2 are designed to operate

{

independent of each other. Each standby diesel generator and load group in one I

unit is also physically separate and electrically independent from the other

[

l two standby diesel generators and their load groups. Presently, the total load on any one diesel generator is within its continuous full load rating of 5500 kW. The applicant has committed to limit any load increase in the future to be within its 2000-hr rating of 5935 kW. The diesel generator is, however, capable of operating at 11% of the continuous rating for two hours out of any 1

24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of operation with no reduction in maintenance schedule. All those non-Class 1E loads which may be sequenced or manually switched to the diesel

(

generator during a loss of offsite power, are automatically isolated upon

l receigt'of an SI signal and may be manually loaded after resetting the SI l

signal.

l i

j The ac control power for vital instrumentation and controls in each unit is provided by six uninterruptible power supplies (UPS). Each of the UPS consist l

of a solid state inverter / rectifier system, a de and an ac supply to the j

inverter / rectifier and a manually operated, mechanically interlocked circuit breaker in each distribution panel to permit energization of the bus either by the corresponding inverter / rectifier or by an alternate 120V ac, single phase, regulated, backup source.

Four of these UPS are Class IE. Two of these four l

Class IE UPS supply power to instrumentation channel I and II and have their separate ac and de power supplies from train A.

The other two UPS supply l

channels III and IV and have their power supplies from train B and C respec-tively. Normal source of power to the UPS is 480 volt ac power. Upon loss of power from the 480V ac, the UPS is automatically powered by 125V de system I

through an auctioneering circuit. There are no manual or automatic intercon-nections for switching between the redundant safety-related UPS, between the l

l safety-related and nonsafety-related UPS or other nonsafety-related systems.

l The staff identified concerns about the usage of Ferro-Resonant transformers in Westinghcuse inverters or the regulated source of the backup power supply.

t Certain deficiencies were identified in these transformers by 1E Information SOUTH TEXAS SER 8-10

L o

l i

l l

[

f Notice 84-84 The applicant has committed to corrective action in their letter l

j toNRC(ST-HL-AE-1215)datedMarch 29, 1985 for all such transformers consis-

[

l tent with Westinghouse Technical Bulletin NSD-TB-84-11. The staff found this l

lf corrective action acceptable.

l The onsite, safety-related power system is provided with protective devices to l

isolate faulted equipment and circuits, prevent damage to equipment and mini-l l

mize system disturbances. Each voltage level (4150V, 480V and 208/120V) are

[

j provided with protective relaying with primary and backup protection against i

various faults and overload cenditions. The relay settings are coordinated for selective tripping (primary before backup) and quickly isolate the fault before any excessive damage. Solid state relays are extensively used to minimize setpoint crifts. Also periodic testing of these relays and verification of j

their settings ensure reliable operation of the onsite power system.

l Each standby diesel generator is provided with various protective trips listed i

in the FSAR. All these trips remain functional during periodic testing of the t

l diesel generator. However, during emergency, all but the generator differen-f 1

i i

tial, engine overspeed and low lube oil pressure trip are automatically by-

[

i passed. The bypassed protective trips are alarmed in the control room to alert l

I the operator for an appropriate action.

Position 7 of Regulatory Guide 1.9 (Revision 2) allows engine overspeed and generator differential to trip the diesel generator by a single channel

[

trip. All other diesel-generator protective trips are to be implemented with two or more independent measurements for each trip parameter with coincident l

logic or be bypassed under accident conditions provided the operator has i

sufficient time to react appropriately to an abnormal condition of the diesel I

generator. The applicant is retaining engine overspeed and generator differen-f tial with a single channel trip and low lube oil pressure with coincident logic f

f during an accident and bypassing all other protective trips maintaining that

{

l the operator has sufficient time to respond to an alarm for an abnonnal condi-i l

1 i

SOUTH TEXAS SER 8-11 i

i f

i

j 1

i l

l tion. This is in compliance with the regulatory guide and is, therefore, acceptable.

I i

Each of the three trains in each unit is provided with two levels of under-i voltage schemes at the 4160 volt bus. The first-level scheme called " loss i

of voltage" utilizes four undervoltage relays in a 'two-out-of-four logic and f

time delay of 0.5 to 5.0 seconds to isolate the safety-related buses from the offsite power system, disconnect selected loads and start and load the associated diesel generator through its sequencer. The second level scheme

{

called " degraded grid voltage" also utilizes two-out-of-four logic with a 5.0 i

to 50.0 second time delay. These relays are set to alarm in the control room on a tolerable degraded bus voltage. Should an SI signal be present coincident with degraded voltage, the sequencer enters Mode III state which is loss of offsite power coincident with SI signal. This causes trip of offsite power i

source breakers, startini nd loading of diesel generator with the accident loads. However, if degraded voltage persists beyond time settings, or further degrades for nonaccident conditions, the degraded volta:e relays or loss of voltage relays will cause the sequencer to enter Mode II which is a loss of j

offsite power.

In this mode, the offsite ac power breakers are tripped and the l

diesel generator is started and loaded with the shutdown loads. The voltage j

and time delay setpoints for both loss of voltage and degraded voltage scheme l

relays will be selected when STP completes their analysis of the onsite distri-i bution system voltages in compliance to BTP-PSB-1 and will include them in the technical specification. The staff will provide its evaluation of the analysis and the setpoints in a supplement to this report.

The BTP-PSB-1 further requires that the Class 1E bus load shedding scheme

]

should automatically prevent load shedding during sequencing of the emergency i

loads to the bus. The load shedding feature should, however, be reinstated upon ecmpletion of the load sequencing action. The technical specifications l

must include a test requirement to demonstrate the operability of the automatic bypa'ss and reinstatement features at least once per 18 months during shutdown.

l

^

t l

I I

4 SOUTH TEXAS SER 8-12

[

i

o l

k 1

I l

Regarding this requirement, the applicant indicated that the STP design automat-ically prevents load shedding during sequencing of the emergency loads on the diesel generator. Upon completion of sequencing, load shedding feature rein-l statement is accomplished by manually resetting the reset button in the main control room or at the sequencer panel. The technical specifications will include testing of the automatically bypassed load shedding feature during load sequencing on the diesel generator and the manual operation for its reinstate-l The staff's evaluation found this design feature in com111ance with the ment.

j requirements of the BTP-PSB-1 and is, therefore, acceptable.

)

i j

The STP design utilizes solid state ESF load sequencer, one for each of the j

three load groups. Each sequencer has independent sensor channels, power supplies and actu6ted devices. No credible sneak circuit could be identified to occur to render sensors, power supplies, or actuated devices inoperable.

l l

j The staff required the applicant to provide the results of a reliability analy-sis for the solid state ESF load sequencer. The applicant has comitted to submit the results and the staff will provide its evaluation of those results j

in a supplement to this report.

I I

To ensure safe and proper operation of the system, the following design fea-tures are incorporated:

l I

(1) In the automatic mode, the standby diesel generator breaker control has l

permissive interlocks to prevent closing the breaker until the standby l

diesel generator attains approximately 95% of rated voltage and frequency.

(

l l

(2) Each 4.16 kV ESF bus supply breaker and the generator breaker for its l

corresponding standby diesel generator are interlocked in such a manner that it is not possible for the diesel generator breaker to close automat-ically unless the 4.16 kV ESF bus supply breaker is open. However, the bus normal supply breaker and the diesel generator breaker can be manually l

i closed to provide parallel operation for periodic testing of the diesel l

SOUTH TEXAS SER 8-13

w generator sets.

If during the test, an emergency start signal is received (SI/ LOOP or both), both diesel generator control and sequencer will revert from the test mode to the emergency mode in compliance with RG 1.108 which q

requires that the periodic testing of diesel generators should not impair the capability of the unit to supply emergency power within the required time.

i (3) Both the 4.16 kV ESF bus supply breakers (nomal and standby generator I

feeds) are tripped and locked out upon the occurrence of a bus fault for that particular bus (Train A, B or C).

The staff reviewed the diesel generator alarm and status information (bypass or inoperability) provided for the control room operator. The bypass or inoper-ability status of each standby diesel generator is automatically indicated in the control room through the ESF status monitoring system. The FSAR identifies I

a number of conditions that will render the diesel generator incapable of responding to an automatic emergency start signal. These conditions are alarmed through the ESF Status Monitoring System and each condition has its individual alarm windows. These conditions are limited to those within the

]

diesel generator system itself. We find the alarming of inoperable conditions within the diesel generator system acceptable.

i The staff requires diesel generator qualification tests in accordance with IEEE-387 as modified by RG 1.9.

The applicant has committed to comply with the i

requirements of the IEEE Standard and the regulatory guide. There will be a j

300 valid start and load tests and at least two acceptable full load and margin i

tests on a diesel generator unit of the type and size used at STP and manufac-k tured by Cooper Energy Services prior to initial fuel loading. This IEEE I

Standard also requires that the load acceptance test should consider the potential effects on load acceptance after a prolonged no load or light load operation of the diesel generator. The applicant will perform a test by applying load up to 100% of continuous rating of the diesel generator immedi-ately folicwing six hcurs of no load operation of the diesel generator. The l

E SOUTH TEXAS SER 8-14

,__,,_,,,-c,o

--.-ne----.mm~

v>--,

-v-r-

-.-,,e

o f

4 i

J applicant has committed to submit the results of start and load tests, full load and margin test and the load acceptance test after prolonged no load operation of the diesel generator. The staff will provide its evaluation of these tests and results in a supplement to this report. Further to this, the applicant will include in their station operating procedure to operate the diesel generator at a minimum of 50% load for one hour after every six hour cumulative no load and/or light load (less than 50% rating) operation of the

)

diesel generator as per the manufacturer's recommendation. The staff found l

this ace.eptable.

The STP design of safety related electric power system has provision to permit periodic inspection and testing of its components during equipment shutdown, periodic testing of the components for their operability and functional perfor-mance during normal plant operation and testing the operability of the Class 1E i

system as a whole during plant shutdown. Testing during shutdown simulates I

conditions as close to design as practical and operates the system as a whole l

including operation of signals of the ESF actuation system, the transfer of ESF l

buses between the offsite and the onsite power system and loading and unloading l

of ESF electric equipment to and from their respective power supplies.

The FSAR includes the following exceptions in the STP design from the require-ments of RG 1.108 " Periodic Testing of Diesel Generator Units."

i (1) Section C.2.a.3 of the guide requires the preoperational and every 18 month tests to include full load capability test for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, of which 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> should be at the load equivalent to the continuous rating of the diesel generator and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> at the load j

equivalent to the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating of the diesel generator. STP technical specifications call for 22 hour2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> operation at the continuous rating as j

required by the guide but 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> operation at the 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> rating instead j

of the ? hour rating of the diesel generator. The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating test will j

be performed on each STP diesel generator only once under the preoperz-tional test program. The FSAR states that the type qualification test 1

i SOUTH TEXAS SER 8-15 I

)

performed on an STP diesel generator proved that it can operate at the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> out of any 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of operation with no reduction in annual maintenance interval. The 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating test, if performed on 18 month interval basis, will impose unnecersary stresses on the machine since the maximum load required for the design basis accident shall not exceed the 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> rating of the diesel generator. The applicant has committed to add in the FSAR that no transient effect or future addition of loads on the emergency buses will exceed the 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> rating of the diesel generator. The staff found the exception and the committed FSAR changes acceptable.

(2) The criterion of first out alarm for diesel generator protective trips as specified in position C.I.b.5 of the guide, to facilitate trouble diagno-sis, is not implemented in the STP design. The first out alarm does not reduce the damage to the diesel generator or the down time of the diesel generator. The staff evaluation of this exception does not identify any safety problem if the first out alarms are not provided and hence the exception is acceptable.

t 8.3.2 DC Power Systems The Class IE de power system in STP design provides de control and motive power to Class 1E equipment during all normal and emergency conditions of the plant.

The objective of the staff review is to determine that the Class 1E de power systems are designed in accordance with the criteria in Section 8.1.1 of this report. The evaluation establishes whether the design has the required redun-dancy, meets the single failure criterion and has the capacity and capability to supply de power to all required safety loads.

The Class IE,125V battery system in each of the two units consists of four independent, physically separated, ungrounded batteries, sized in accordance with IEEE 485-1978. Each battery is energized by two chargers. Each battery I

i consists of 59 lead calcium type cells mounted on seismic Category 1, corrosion

[

SOUTH TEXAS SER 8-16

l 1

i resistant steel racks.

These four de systems are designated Channels I, II, III and IV. Channels I and II de systems are powered from and supply to components in train A whereas Channels III and IV are powered from and supply to the components in trains B and C respectively. Both chargers are needed in Channels I and IV during normal operation to supply the loads and float charge the battery whereas Channels II and III each need only one charger at any one time. The two battery chargers associated with a given battery are supplied from separate MCCs connected to double ended sections of a switchgear to enhance the reliability of each de bus. Each battery system also supplies power to its associated inverter for the vital instrumentation and protection system. Upon loss of power from the ac system to the chargers, the batteries automatically assume the loads.

The ampere hour-capacity'of each battery is sufficient to provide, for a minimum of two hours, the power required by emergency de controls and vital ac instrumentation and protection system to shut down the reactor and maintain it in a safe shutdown condition.

The battery chargers serving the safety-related de systems are rated to supply the largest combined demands of the various steady-state loads while restoring the battery from the design minimum charge state to the fully charge state.

l Each of the four 125V Class IE batteries are located in separate rooms in a seismic Category 1 building which inhibits the propagacion of fire and provides protection against missiles. Battery chargers and distribution panels associ-ated witn a given battery are located outside of the battery room. Each battery room is provided with a Heating, Ventilating, and Air Conditioning (HVAC) System through separate intake and exhaust ducts and energized by the ESF bus. This system is designed to limit the hydrogen concentration to less than 2% by volume at any location within the battery area. The Class 1E de power systems are designed to withstand the effects of tornadoes, fires, and the Safe Shutdown Earthquake (SSE) without loss of function.

Flooding of the r

l l

SOUTH TEXAS SER 8-17 j

D 0

battery rooms is precluded by the elevation and location of the battery rooms in the Mechanical-Electrical Auxiliaries Building.

Each de system is provided with an annunciator window having inputs froc each of the two chargers and the switchboard. The computer may be used to identify which of three inputs is being alarmed.

Each battery charger is provided with the following alarm circuits which are connected in common to the control room annunciator / computer to indicate battery charger trouble:

1.

input undervoltage (ac) 2.

output under and overvoltage (dc) 3.

de ground 4.

output breaker position (alarm when open)

Each 125V de switchboard has the following alarm circuits which are connected in comon to the control room annunciator / computer:

i 1.

input breaker position from battery charger (alarm when open) 2.

input breaker position from battery (alarm when open) 3.

battery overcurrent (computer only) 4.

batterychargernocurrent/overcurrent(computeronly) l S.

de bus ground and over/under voltage (combined) l The following indicating instrumentation for each switchboard is provided in l

I the control room:

1.

bus voltage 2.

battery current 3.

battery charger current SOUTH TEXAS SER 8-18 i

4 1

In addition to the above, the STP design includes sensors, instrumentation and alarms in the control room for hydrogen and fire detection. Also each battery charger is equipped with a de voltmeter and an ammeter. Protection against power feedback from the battery to the charger, upon loss of the ac source, is i

provided.

The staff review of these instrumentation and alarms found that the STP design does not include " Battery High Discharge Rate" alarm.

In the absence of this alarm, the control room operator will only know of a discharging battery when j

he periodically checks the battery current indicating instrument or when the battery has sufficiently been discharged to trip the undervoltage alarm. The applicant's response identified that beside the indicating instrument, the current flow frcm the battery to the de distribution switchboard, is alarmed in the control room at a preset level via the " Emergency Response Facility Data Acquisition Display System" computer. This alarm alerts the operator to the battery discharging conditions.

I The staff fcund the computer alarm for the " Battery High Discharge Rate" 1

j acceptable.

{

The staff's concern regarding the capability of the de equipment, to safely j

withstand and prcperly operate at the maximum and minimum battery voltages, was transmitted to the applicant. Their response provided the following information:

i Minimum battery voltage at two hour duty cycle is 106 volts and the minimum j

voltage required by the control equipment is 100 volts. The battery float voltage is 132V de and the equalizing charging of the battery requires a i

maximum of 141V dc. All the 125V de, Class IE equipment will be qualified for operation over voltage range of 105 to 140 volts.

In addition, all the 125V de Class IE loads will be tested to verify correct operation at the maximum and minimum system voltages. The response also indicated that no non-Class IE loads are supplied from the Class 1E 125V de system.

4 SOUTH TEXAS SER 8-19 i

i.

1 9

All equipment of the Class 1E de power systems is located in a ventilated.

l controlled environment outside of the Reactor Containment Building (RCB).

i Cables or supporting structures penetrating into the RCB are designed to operate in the post-accident environment for the period of time required to I

maintain the plant in a safe shutdown conditions following a Design Basis

]

Accident (DBA).

Independence of the four battery systems is secured by separa-l tion of cables and equipment and by prohibiting cross-ties between load groups in different trains.

t I

i Periodic testing of the Class 1E de power system equipment is performed in accordance with RG 1.32 to verify the de system's ability to perform its safety function. The batteries and chargers are inspected and tested in accordance with the technical specifications.

l l

Additional testing in accordance with RG 1.129 is also performed.

4 The staff identified its concern regarding the battery failure during a seismic event due to the swollen positive plates and/or cracked cases of the battery cells. These concerns were transmitted to all applicants through IE Information l

Notices 83-11 and 83-83.

The applicant, in their response, stated that the STP batteries are qualified in accordance with IEEE 535-1979 which requires that the increased seismic vulner-ability of old batteries be reflected in the qualified life of a battery. Also the STP design includes 20 percent spare capacity for future load. STP is continuing the review of the load to ensure that adequate capacity is main-i tained. Also the manufacturer's recommendation, regarding the use of solvent I

as cleaning agent and procedure for cleaning the battery post, is included in I

their instruction manual. STP has evaluated the concerns of IE Notice 83-11 and 83-83 and found that it has no impact on STP Class 1E batteries.

l SOUTH TEXAS SER 8-20 I

- -. ~... -..

1 1

8.3.3 Compliance With GDC Reouirements This section presents features of onsite ac and de power system and components to establish design compliance to the GDC listed in Section 8.1.1 of this report.

8.3.3.1 Compliance With GDC 2 and 4 The STP design has met the requirements of GDC 2 and 4 with respect to struc-l tures, systems, and componer.ts of the onsite ac and de power system being capable of withstanding the effects of natural phenomena (such as earthquakes, tornadoes, hurricanes, and floods), missiles and environmental conditions associated with normal operation and postulated accidents. The onsite power system and components (1) are located in seismic Category 1 structures which l

provide protection from the effects of tornadoes, tornado missiles, turbine missiles, and external floods; (2) have been given a quality assurance designa-tion Class IE; (3) have been designated to be seismically and environmentally qualified; and (4) are to be designed to accommodate or are to be protected 2

from the effects of missiles and environmental conditions associated with normal operation and postulated accidents.

8.3.3.2 Compliance With GDC 5 The STP design has met the requirements of GDC 5 with respect to structures, systems, and components of the ac and de onsite power system. The onsite power system and components associated with Units 1 and 2 are housed in physically separate seismic Category 1 structures and are not shared.

8.3.3.3 Physical Independence (Compliance With GDC 17)

All redundant equipment and circuits are separated by physically locating them in separate areas, separating by distance in the same area and/or providing 1

i barrier between them.

I 1

SOUTH TEXAS SER 8-21 l

i i

i 8.3.3.3.1 Separation of Equipment By Location l

1.

The main transformers and the unit auxiliary transformer of each unit are located outdoors and are separated from each other by fire walls provided between the transformer units to confine a fire in any unit.

~

1-l The standby transformer is located on the opposite side of the turbine generator building (TGB) from that of the main transformer and the unit auxiliary transformer.

1 j

The 138 kV emergency transformer is located near the switchyard and remote frcm any of the other large transformers.

The main generator breaker is located outside the TGB.

2.

Class 1E electrical equipment are located in a structure or building which.

j has a seismic Category I classification. These buildings or structures l

are so designed as to protect the Class IE electrical systems from such postulated events as floods, hurricanes, and other natural events.

j In general major Class 1E electrical power distribution equipment located j

in the Mechanical-Electrical Auxiliaries Building (MEAB) are arranged so that each train of the three-train ESF System is located on a different floor elevation. Separate rooms or compartments are also provided within l

each elevation to enhance the physical and electrical independence of each train.

The standby diesel generators are each located in a separate room of the Diesel-Generator Building (diesel generator B). The associated Class 1E f

electrical equipment located within each standby diesel generator room is so located and protected within the room as to minimize the possibility of l

damage due to internally generated missiles, pipe ruptures, fire, etc.

3 However, occurrence of any of these events does not affect the ability of i

{

SOUTH TEXAS SER 8-22 l

l. -. -

the remaining trains of the ESF system to perform their safety function, since no two trains of Class IE equipment or cables are located in or routed through any of the other standby diesel generator rooms.

Non-Class 1E equipment located within seismic Category 1 structures or buildings is arranged so that a loss of or damage to this equipment cannot prevent the Class IE equipment from performing its safety function. This is accomplished by isolation of such equipment from the Class IE equipment by means of physical barriers, compartments, or suitable physical separation.

3.

Electrical penetration assemblies are provided for cables entering the Reactor Containment Building. Separate quadrants at three different elevations are selected for locating these penetrations. Three penetra-tion areas are utilized for separate ESF trains and the RPS channels.

In t

areas where penetrations for both an ESF train and an RPS channel are located, the penetration assemblies are grouped separately. Centerline to centerline separation between adjacent electrical penetrations within a given train or channel is 4 ft.

Control and instrumentation penetrations for RPS Channels I and II are located at the same elevation. However, penetrations associated with these RPS channels are adequately separated to ensure their integrity during any possible event.

8.3.3.3.2 Physical Identification of Safety-Related Ecuipment All Class 1E equipment is provided with color coded nameplates. Safety related trays and conduits are identified by unique numbers and color to designate their train, channel or separation group at an interval not exceeding 15 feet.

Similarly all safety-related cables are color coded in accordance with RG 1.75.

l l

l SOUTH TEXAS SER 8-23

8.3.3.3.3 Raceway and Cable Separation Cable trays within a given train or a separation group are separated on the i

basis of function and voltage class.

Instrumentation cables and other low level signal cables are routed in separate raceways from power and control cables. Class IE circuits of various separation groups are routed in separate penetrations, cable trays, conduits and ducts to assure complete separation.

The FSAR description indicates that routing of the Class 1E raceways, field cable terminations in an enclosurer and the internal wiring and layout of various components in the enclosure are in compliance with the requirements of

)

RG 1.75 and IEEE Standard 384.

4 i

The FSAR lists the following raceways as considered to be totally enclosed raceways:

rigid steel conduit aluminum sheathed cable and copper sheathed cable enclosed metal wireways (gutters) flexible metal conduit ventilated steel cable trays with solid steel covers installed at top and bottom of tray solid bottom tray with solid steel covers The staff had concerns regarding the use of aluminum and copper sheathed cables, gutters and flexible metal conduit as totally enclosed raceways and its c,ompliance to the separation requirements of RG 1.75. The applicant's response deleted usage of gutters in STP design and provided the following explanation i

for the usage of aluminum and copper sheath cable and flexible metallic conduit as totally enclosed raceway.

In STP design, the aluminum and copper sheathed cables (ALS and CS) are of continuous, seamless, water impervious metallic sheath construction and are typically used in lighting and fire protection circuits. Test results of ACS and CS cable with one inch vertical separation from an open tray has been SOUTH TEXAS SER 8-24

s s

submitted to NRC by other applicants. The STP applicant has comitted to submit these test results as applicable to STP for our evaluation. The staff will provide its evaluation of these test results in a supplement to this report.

4 The flexible metallic conduit used in STP design is a continuous, seamless, corrugated hose made of stainless steel. This flexible conduit does not constitute a separation barrier by itself. However, two of these conduits separated by one inch or one flexible conduit and any other qualified enclosed raceway separated by one inch and carrying redundant circuit cables, are considered as totally enclosed raceways. The staff found this explanation acceptable.

In pipe failure hazard areas, the separation of conduit and cable trays is accomplished by the use of barriers, restraints, separation distance or the appropriate combination of these methods. Where it is not possible to prevent damage to a Class 1E raceway in the event of a pipe failure, an analysis is performed to assure that safe shutdown capability is maintained.

Where Class IE cables must be installed between seismic Category 1 structures and where no physical connections exist for continuation of exposed trays or conduits, underground Class IE duct systems are provided. Separate ducts are provided for each Class 1E separation group; however, since the ducts are enclosed in reinforced concrete, the duct enclosure for all separation groups may be common.

Instrumentation cable and cables of different voltage levels are routed within manholes in a manner that maintains a separation comensurate with that outlined for general plant areas.

The sertical and horizontal separation distances between redundant separation groups are not less than the minimum acceptable separation distances of 3 ft.

horizontally and 5 ft. vertically for general plant areas. The two groups of divisional cables going to the control room are generally routed through separate cable chases and cable spreading rooms within the auxiliary building.

One group enters the lower cable spreading room while the other group enters the upper cable spreading room.

j SOUTH TEXAS SER 8-25

4 i

Cable trays, conduits and their supports for Class 1E circuits are designed to 4

i comply with the seismic Category 1 requirements. Cable tray supports for non-Class 1E circuits which are located in areas containing Class IE equipment I

are also designed to comply with seismic Category 1 requirements.

i i

8.3.3.3.4 Associated Circuits and Isolation Devices Some circuits have equipment that are not qualified as Class 1E and do not perform a safety function but which are connected to the 1E system through 7

isolation devices. These circuits which by RG 1.75 definition are classified as " associated," are identified as Class 1E from the Class IE source up to and l

including the isolation device. The circuit from the isolation device to the j

equipment is identified as non-Class 1E unless it otherwise becomes associated by sharing an enclosure or raceway with Class 1E equipment or circuits.

j Therefore, associated circuits are not identified as such but either as Class l

1E or non-Class IE. As an example, some'non Class 1E devices which are located i '

in the turbine generator building (a non-seismically designed building) but are 1

connected to Class IE circuits are routed in dedicated non-Class IE rigid steel conduit.

The STP design uses the following devices in the Class IE ac and de power j

systems as isolation devices:

1.

Class 1E isolation transformers 2.

Class 1E thermal magnetic trip devices which are tripped on receipt of an SI signal 3.

Class 1E control switches with 6" separation or barriers between separation groups 4

4.

Control circuit fuses (Class IE) which isolate the non-Class IE i

circuit prior to the operation of the Class 1E circuits protective device 5.

Class IE relays with barriers SOUTH TEXAS SER 8-26

1 6.

Redundant Class IE thermal magnetic trip devices in series 7.

Class 1E current transformers The staff finds that the STP design has met the requirements of GDC 17 with respect to physical independence of the circuits and components of the ac and de onsite power systems.

8.3.3.4 Compliance With GDC 18 The STP design has r.et the requirements of GDC 18 with respect to the onsite ac and de power system. The onsite power system is designed to be testable during j

station operation as well as when the station is shut down.

8.3.3.5 Compliance With GDC 50 To meet the requirements of GDC 50, the containment electrical ~ penetration assemblies should be designed, installed and tested following the guidelines of IEEE Standard 317, as augmented by the recommendations of RG 1.63. The FSAR lists compliance of STP containment electrical penetrations to the IEEE Stan-dard and revision 0 of the regulatory guide. The applicant had indicated that STP design difference, if any, from the requirements of the current Revision 2 of the regulatory guide, shall be submitted with justification for the staff review. The following features of the electrical penetration and its protec'-

tion are identified in the FSAR.

i Both safety-related and nonsafety-related electrical penetrations are protected against sho't-circuit current by means of coordinated source and feeder break-ers. Where coordinated breaker protection cannot be achieved, a redundant breaker in series is provided with identical tripping characteristics. All 125V circuits going through penetrations are protected by double pole fuses in series to provide redundant protection.

Field cables to the penetration are capable of carrying the load current based on the penetration conductor j

ampacity as calculated for the penetration protection. The applicant has SOUTH TEXAS SER 8-27 I

~_

4 e

i committed to provide coordinated primary and backup protection curves for the circuits passing through electrical penetration with a simplified one line diagram showing circuit configuration of each type of~ penetration conductors j

and also the maximum available fault current to the penetrations.

The staff is concerned regarding the uncertainty in protection of the penetra-tion, especially the medium voltage reactor coolant pump penetrations, whose i

protective components are located in a noncontrolled environment.

In such conditions, the relay setpoint drift within the tolerable band, especially for solid state relays, may not be adequately verified by a proposed 18 month test interval for the penetration protective devices. The applicant has committed to verify that the said relay drift will be within the allowed band during tt'e 18 months test schedule. The staff will provide its evaluation of the applicant's committed submittals in a supplement to this report.

f Except as noted above, the STP design has met the requirements of GDC 50.with l

respect to electrical penetrations containing circuits of the safety and nonsafety onsite power system.

i 8.3.4 Design Features of Additional Electrical Subsystems This section of the report includes staff's review of the design features of certain electric subsystems and components important to safety.

8.3.4.1 Submeraence of Electrical Equicment as a Result of a LOCA The staff has been concerned that, after a LOCA, fluid from the reactor coolant l

systen and from operation of the emergency core cooling systems (ECCS) may collect in the primary containment and reach a level that may cause certain i

electrical equipment located inside the containment to become submerged, 1

l thereby rendering it inoperable. Both safety-and nonsafety-related electrical equipment is of concern, because its failure may cause electrical faults that 1

SOUTH TEXAS SER 8-28

a b

l could compromise the operability of redundant Class IE power sources or the integrity of containment electrical penetrations.

The applicant's response to the staff's concern provided a list of such equip-ment. All of the listed equipment are non-Class 1E and their failure (spurious actuation or loss of actuation function as a result of submergence) has no effect on the Class IE pcwer source.

8.3.4.2 Bypass of Thermal Overload Protection Motor-operated valves with thermal overload protection devices for the valve motors are used in safety systems and their auxiliary supporting systems.

Operating experience has shown that indiscriminate application of thermal overload protection devices to the motors associated with these valves could result in needless hindrance to successful completion of safety functions. RG 1.106, " Thermal Overload Protection for Electric Motors on Motor-Operated Valves," states that:

In order to ensure that safety-related motor-operated valves whose motors are i

equipped with thermal overload protection devices integral with the motor starter will perform their function, one of the two alternates described in regulatory position 1 or the one described in regulatory position 2 should be implemented.

1.

Provided that the completion of the safety function is not jeopardized or that other safety systems are not degraded, (a) the thermal overload protection devices should be continuously bypassed and temporarily placed in force only when the valve motors are undergoing periodic or maintenance testing or (b) those thermal overload protection devices that are normally in force during plant operation should be bypassed under accident conditions.

1 i

SOUTH TEXAS SER 8-29

I 2.

The trip setpoint of the thermal overload protection devices should be established with all uncertainties resolved in favor of completing the safety-related action.

In the STP design, the overload protective devices for motor operated valve in all safety systems are continuously bypassed from tripping the breaker for an overload, but are utilized to provide an alarm for the overload condition. The STP design does not temporarily place these overload protective devices to trip during periodic or maintenance testing of the valves. This exception from regulatory position is to prevent any malfunction due to switching these overload device contacts in and out of the circuit during valve testing and back to the normally bypassed state.

If any anomaly occurs during testing of a i

motor operated valve, the overload alarm in the control room will alert the operator to act immediately.

The staff did not identify any safety concern in this approach and hence found STP design acceptable. However, we believe that the use of thermal overload in POV circuits during periodic or maintenance testing is a prudent operational j

practice to minimize motor damage and the staff does not recomend its virtual

]

elimination based on an alarm, i

1 8.3.5 Conclusions t

On the basis of its evaluation of the FSAR description of the STP design, the staff concluded that the Class 1E onsite electric power systems meet the criteria in Section 8.1.1 of this report. Both ac and de Class 1E systems are independent, meet the single failure criterion, are testable and have capacity and capability to provide control and motive electric power to safety equipment l

in order to mitigate the consequences of a design basis accident and achieve a I

safe shutdown of the plant when required. The STP design of the onsite power system is, therefore, found acceptable contingent to the staff evaluation and acceptance of applicant's submittals on various items identified in this report.

i i

SOUTH TEXAS SER 8-30

- - ~ _ _

i l

15 ACCIDENT ANALYSES 4

l i

i The accident analyses for STP have been reviewed in accordance with Section 15 l

of the SRP (NUREG-0800).

Conformance with the acceptance criteria, except as 1

j noted for each of the sections, formed the basis for concluding that the destgn t

j of the facility for each of the areas reviewed is acceptable.

Two types of events were analyzed:

(1) anticipated operational occur rences, (A00s), i.e., those events that might I

be expected to occur during the lifetime of the reactor I

i i

j (2) postulated accidents (pas), i.e., those events not expected to occur that i

have the potential to result in significant radioactive material release i

The applicant evaluated the ability of STP to withstand a broad spectrum of l

A00s and pas without undue hazard to the health and safety of the public.

The I

results of these analyses are used to show conformance with pertinent GDCs 4

including 10, 15, 17, 26, 27, 31 and 35.

For each event analyzed, the worst operating conditions and the most limiting single failure were assumed, and credit was taken for minimum engineered safe-

]

guards response.

Conservative trip setpoints and time delays to trip were utt-11 zed.

Parameters specific to individual events were conservatively selected.

The staff has asked the applicant to show conformance of the PA and A00 t

i 07/12/85 15-1 SOUTH TEXAS SER SEC 15 0

analyses with GDC 17, specifically loss of offsite power (LOOP).

The applicant responded that the design basis events were analyzed with and without offsite power available.

LOOP was not assumed for the A00 analyses except for the

" Loss of Nonemergency AC Power to the Station Auxiliaries" and " Loss of Normal Feedwater Flow" (Items 15.2.6 and 15.2.7).

The STP analyses assume a 2 second delay between turbine trip and LOOP based on grid stability analyses (this is evaluated in SER Section 8).

The applicant indicated that the minimum DNBR for most A00s would occur in less than 2 seconds after reactor trip.

The cases where minimum DNBR occurs after the 2 second delay, (e.g., " Uncontrolled RCCA Withdrawal at Power -- Small Reactivity Insertion Rata" -- for which DNBR occurs at 2.5 seconds delay) (note to PM:

This is evaluated in the CPB SER input) are bounded by the results of the " Complete Loss of Flow" transient for which minimum DNBR is within the acceptable range (See Section 15.3.1/15.3.2)

All pas were analyzed assuming LOOP with the exception of the locked rotor event.

The applicant has committed to reanalyze this event assuming LOOP (see Item 15.3.3).

The applicant accounts for variations in the initial conditions by making the following assumptions as appropriate for the event being considered:

NSSS thermal power output (includes core and RCP thermal outputs) 3817 MWt, +2%

average reactor vessel temperature (T,yg), 593 1 4.0'F pressure (atpressurizer), 2250 1 30 psi In analyzing the transients and accidents, it was assumed that the pressurizer heaters were not energized.

The applicant was requested to demonstrate the 07/12/85 15-2 SOUTH TEXAS SER SEC 15 m

. -. z.. -.s.

o l

I conservatism of this assumption or to quantify the effects to show that they are negligible.

In response, the applicant has indicated that for cooldown j

transients or departure from nucleate boiling (DNB) limited transients, the j

FSAR assumption is conservative.

For transients such as loss of load, the peak pressure occurs within a few seconds, so that heater effect is negligible.

For steam generator tube ruptures and LOCAs, the assumption of LOOP and decreasing

]

pressurizer level precludes the energization of the heaters.

For the large break LOCA, the break flow controls the system pressure with the heaters again having a negligible effect.

For long term heat up transients, the applicant i

cited WCAP-9230, " Report on the Consequences of a Postulated Main Feedline Rup-

)

ture," as evidence to show that the heaters had a negligible effect.

This is now under NRC review.

l The acceptance criteria for A00s in the SRP include the following:

i i

]

(1) Pressure in the reactor coolant and main steam systems should be main-i tained below 110% of the design values (derived from Section III of the American Society of Mechanical Engineers Boiler and Pressure Vessel Code).

I (2) Fuel clad integrity shall be maintained by ensuring that the minimum DNBR l

(departure from nucleate boiling) will remain above the 95/95 DNBR Limit for PWRs.

t l

(3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

07/12/85 15-3 SOUTH TEXAS SER SEC 15

(4) For transients of moderate frequency in combination with a single failure, or single operator error, no loss of function of any fission product barrier, other than fuel element cladding, shall occur.

Core geometry is maintained in such a way that there is no loss of core cooling capability and control rod insertability is maintained.

Conformance with the SRP acceptance criteria for anticipated operational occur-rences constitutes compliance with GDC 10,15, and 26 of Appendix A to 10 CFR 50.

In response to TMI Action Item II.K.2.17 (Potential for Voiding in the Reactor Coolant System During Transients), the applicant has stated that Westinghouse has performed a study that addresses the potential for void formation in West-inghouse-designed NSSS during natural circulation cooldown/depressurization transients.

This study has been submitted to the NRC by the Westinghouse Owners Group.

As stated in R. Wayne Houston's December 6, 1983 memorandum to Gus C. Lainas entitled, "Multiplant Action Item F-33, Voiding in the Reactor Coolant System During Anticipated Transients," the results of this study have been accepted.

The transients analyzed are protected by the following reactor trips:

(1) Power range high neutron flux (high and low settings)

(2) high pressurizer pressure (3) low pressurizer pressure (4) overpower AT 07/12/85 15-4 SOUTH TEXAS SER SEC 15

~ -

........ : ~

.a O

]

(5) overtemperature AT (6) low reactor coolant flow (7) reactor coolant pump undervoltage (8) low-low steam generator water level (9) high-high steam generator water level The reactor may also trip on other variables for which credit has not been taken in the accident analyses.

This includes source and intermediate range neutron flux, pressurizer high water level, turbine trip, safety injection, and reactor coolant pump underfrequency.

The operators will also have the capability to manually trip the reactor.

i The applicant was requested to discuss the loss of instrument air as a plant transient.

In response, the applicant indicated that this event is bounded by loss of feedwater with LOOP which is an analyzed event (Item 15.2.7).

Limited operator action may be required following some transients.

Some of these actions occur after the plant conditions have been stabilized and an or-derly shutdown is undertaken.

Operator action here would be similar to those of normal shutdown.

Operator action is required for steam generator tube rup-ture (SGTR) mitigation.

This is discussed in Section 15.6.3.

Other operator actions would be to identify and isolate a faulted steam generator from auxil-iary feedwater flow in the event of a steamline break upstream of the MSIV or feedwater line break downstream of the MFIV.

(See items 15.1.5 and 15.2.8),

completion of switchover from injection to recirculation during a LOCA, and switchover to hot leg recirculation (item 6.3).

The applicant has not yet responded to our request for additional information regarding the required i

07/12/85 15-5 SOUTH TEXAS SER SEC 15

..... - =

operator action times for A00 and PA mitigation, including justification that these times are acceptable.

This item will remain open and will be reported in a future supplement to this SER.

In response to a staff inquiry, the applicant provided a tabulation of the most limiting single failure for each analyzed A00 and PA.

The applicant has stated that dose analyses performed for the Chapter 15 A00s and pas were performed assuming Standard Technical Specification S.G. tube leakage.

The applicant was requested to discuss the blockage of certain automatic SI signals during normal shutdown and startup, including information on available alarms and justification of operator action times.

The applicant provided the results of analyses of a LOCA during shutdown.

This is discussed in Sec-tion 6.3.

The applicant stated that a review of STP A00 and PA analyses for all modes of operation and a discussion of the bounding analyses will be performed, as well as detailed confirmation that the technical specifications applicable to modes 3, 4, and 5 are consistent with modes 1 and 2 analyses.

The results would be available in the third quarter of CY 1985.

The staff will provide its evaluation of this item in the final SER.

1 07/12/85 15-6 SOUTH TEXAS SER SEC 15

15.1 Increase in Heat Removal by the Secondary System 7

15.1.1 Decrease in Feedwater Temperature i

The cause of this transient was assumed to be loss of the high pressure feed-water heaters due to opening of the high pressure heater bypass valves and closing the extraction steam valves to these heaters.

Reactor trip on power l

range high flux, overpower AT or overtemperature aT prevents any power excur-sion which could lead to an unacceptable DNBR.

The consequences of this tran-sient are bounded by those in Sections 15.1.2 and 15.1.3.

This is a condition II event.

i 15.1.2 Increase in Feedwater Flow 1

f Increases in feedwater flow can be the result of the full opening of a feed-4 water control valve due to system malfunction or operator error.

This will decrease the temperature of the reactor coolant water.

Due to the negative moderator temperature coefficient this will insert positive reactivity and increase core power.

The applicant states that for these events the high neutron flux trip, overtemperature aT trip, and overpower AT trip prevent any power increase which rauld lead to a DNBR less than the limit value of 1.30.

i The analytical results presented for these events are those where a steam generator (SG) hi-hi level trip closes all feedwater control and isolation valves, trips the main feedwater pumps, and trips the turbine.

Continuous addition of feedwater is prevented by the steam generator hi-hi level signal, which initiates main feedwater isolation and turbine trip.

I 07/12/85 15-7 SOUTH TEXAS SER SEC 15 r

~,-

-~ - - -..

e

,o

, e This transient was analyzed by LOFTRAN which is a digital code that simulates a multiloop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator and SG safety valves.

Two sets of initial conditions were analyzed.

One case assumed the transient initiatirg with the reactor just critical at zero-load conditions and that the malfunction resulted in a step increase in feedwater flow from 0 to 200% of the 3

nominal full-load value for one steam generator.

The other case assumed full-Icad conditions and a step increase to 140% of the nominal feedwater flow to one SG.

The analysis shows that at no-load conditions, the reactor would be tripped at 25% power by pcwer range high neutron flux trip (low setting).

The full power case resulting in the largest power increase assumes manual rod control and maximum reactivity feedback coef ficient.

For this case, reactor trip is initi-ated by overtemperature AT.

The ONBR remains above 1.30.

Minimum DNBR occurs at 27 seconds, and reactor trip at 137 seconds.

Therefore it was not necessary to consider LOOP.

The acceptance criteria for A00s, including conformance with GDC 10, 15 and 26 are met.

15.1.3 Excessive Increase in Steam Flow Increases in steam flow in excess of the capability of the reactor control sys-tem can be caused by an administrative violation such as excessive loading or an equipment malfunction in the steam dump control or turbine speed control.

Four sets of initial conditions were analyzed.

These were:

reactor control in manual or automatic with either minimum or maximum moderator reactivity feed-l i

l 07/12/85 15-8 SOUTH TEXAS SER SEC 15

back.

LOFTRAN was used to analyze this transient.

Full power operation with a 10% step increase in steam demand is assumed.

Protection against the transient could be afforded by either the power range high neutron flux, overpower AT or overtemperature AT reactor trip.

However, I

for the cases involving automatic reactor control, no credit was taken for the aT trips.

In fact, the analyses performed by the applicant show that the reac-tor would not trip but would reach a stabilized condition at the higher power level.

This is qualified for the automatic control cases since the uncertain-ties in the setpoints may result in reactor trip.

In any case, all analyses show the reactor achieving a stabilized condition with the DNBR remaining above 1.30 at all times.

15.1.4 Inadvertent Opening of a Steam Generator Relief Valve or Safety Valve I

The applicant states that the most severe core conditions resulting from an ac-cidental depressurization of the main steam. system other than a steam line l

break are associated with an inadvertent opening of a single steam dump, i

relief, or safety valve.

The suddenly increased steam demand causes reactor power to increase, which results in a reactor trip due to high neutron flux, overpower AT, low RCS pressure, or the trip occurring in conjunction with safety injection.

The continued steam flow through the open valve will cause cooldown which will, because of the negative moderator temperature coefficient, result in positive reactivity.

The safety injection system (SIS) will inject borated water into the primary coolant system on either two out of four pressurizer low pressure signals, or " excessive cooldown protection" signal in any one loop.

(See Section 15.1.5 for a description of the excessive cooldown 07/12/85 15-9 SOUTH TEXAS SER SEC 15

o protection signal.) This ensures the reactor will be shut down during any 1

subsequent cooldown.

The normal steam generator feedwater would be isolated automatically by reactor trip or excessive cooldown protection signal.

DNB does not occur during this transient.

l This transient was analyzed using LOFTRAN.

The initial conditions included having the reactor at just critical (no load) with an end-of-life shutdown mar-gin, equilibrium xenon conditions.

The most reactive rod cluster control as-j sembly was assumed to be stuck in the fully withdrawn position and the single f

failure assueed was one SI train so as to minimize the boric acid injection.

t j

The transient was assumed initiated by the valve with the highest rated steam i

)

flow capacity that relieves outside the secondary system.

The no-load 4

L condition, in conjunction with offsite power available, all RCPs running has been assumed in order to maximize the cooldown transient that follows the valve opening.

)

The appitcant has stated, in response to a staff concern, that although the i

L pressurizar empties during this transient, void formation in the RCS will not t

j occur because the coolant enthalpy will remain well below the saturation i

enthalpy corresponding to the prevailing RCS pressure,

)

l j

The applicant's analyses show that for transient events leading to an increase I

in heat removal by the secondary system, the minimum DNBR remains abob $ the

{

design basis Ifmit of 1.3.

Thus no fuel failure is predicted to occur, core j

geometry and control rod insertability are maintained with no loss of core l

cooling capability, and the maximum reactor coolant system pressure remains below 110% of design pressure.

The staff finds the results of these analyses I

f l

v 07/12/85 15-10 SOUTH TEXAS SER SEC 15 l

l

1[

o i

}

in conformance with the acceptance criteria of SRP 15.1.1 through 15.1.4, and, therefore, acceptable.

i 15.1.5 Steamline Rupture Accident I

l The applicant has submitted analyses of postulated steamline breaks that show no fuel failures attributed to the accident.

These results are similar to those obtained for previously reviewed Westinghouse four-loop plants, i

f

~

P A postulated double-ended rupture at hot shutdown condition was analyzed as the i

j worst case.

The applicant referenced WCAP-9226 as justification for this i

selection. WCAP-9226 is currently under review by the staff.

The LOFTRAN code j

was utilized.

The applicant has stated that the steam generators have integral i

flow restrictors with a 1.4ft* throat area, therefore any rupture with a break

)

area greater than 1.4fta, regardless of location, will have the same effect on i

i j

the system as a 1.4ft1 break.

The doubled-ended rupture would cause the l

l reactor to increase in power due to the decrease in reactor coolant i.

temperature.

i If the reactor were at power, it would be tripped by either reactor overpower AT, by high neutron flux, the actuation of the SIS, or by low pressurizer pres-i sure.

The SIS will be actuated by either two out of four low pressurizer pres-

)

sure signals or " excessive cooldown protection." The transient is terminated 4

using only safety grade equipment.

The injection of highly borated water t

i ensures the reactor is maintained in a shutdown condition.

The " excessive I

cooldown protection" consists of either (a) two of three compensated steamline

[

}

j low pressure signals in any steamline, or (b) two of three low-low compensated i

t 07/12/85 15-11 SOUTH TEXAS SER SEC 15

--,_..---.-,,r.

, - -, - - - - -. - - - ~ ~,, - - - - -

yv.v m

,-n,-,-.e--w,,,n-,-

--,-m--

v~,-.-

e

~w-~., - - -~.,,,,

,,e,e-mw,--

i o

Tcold signals in any RCS loop coincident with P-15, which is defined as two of four ir.struments indicating a neutron flux below 10% or a reactor trip.

This protection system is evaluated in Section 7.

The applicant analyzed this transient with and without offsite power available.

As a result, both full reactor coolant system flow and loss of flow were considered with the full flow case determined to be more limiting.

The initial conditions included end-of-life shutdown margin, no load and the most reactive rod cluster control assembly stuck out.

A single failure was chosen so as to minimize boron injection.

Fast acting main steam isolation valves (MSIVs) are designed to close in less than 10 seconds from either SI actuation signal or high negative steam pressure rate in any loop below P-11 (note:

P-11 has not yet been defined).

This is further discussed in Section 15.6.3.

Thus blowdown is limited to one SG.

Voiding in the reactor vessel upper head would occur for about 70 seconds, with the maximum void volume being less than 20% of that of the upper vessel head.

i

~

In addition to assuming offsite power available, and thus full reactor system coolant flow, other assumotions were made so as to maximize the cooldown tran-sient that ensues the postulated steamline break.

These assumptions included a conservatively high auxiliary feedwater (AFW) flow rate, minimum temperature and immediate delivery of auxiliary feedwater to the steam generators.

The staff concludes that the consequences of postulated steamline breaks meet the relevant criteria in GDC 17, 27, 31, and 35 regarding control rod insertability and core coolability and THI Action Plan items.

This conclusion is based upon the following:

07/12/85 15-12 SOUTH TEXAS SER SEC 15

(1) The applicant has met the criteria of GDC 17, by performing the analysis for this event with and without offsite power available. The result of the "offsite power available" case were more severe.

(2) The applicant has met the criteria of GDC 27 by demonstrating that the re-activity control systems can reliably control reactivity changes to assure that with the most reactive rod stuck in the withdrawn position core cool-ing will be maintained.

The minimum DNBR is greater than 1.3, and no fnel damage is predicted.

(3) The applicant has met the criteria of GDC 31 with respect to demonstrating the integrity of the primary system boundary to withstand the postulated accident.

(4) The applicant has met the. criteria of GDC 35 with respect to demonstrating the adequacy of the emergency cooling systems to provide abundant core cooling and reactivity control (via boron injection).

The STP steam line break analysis is acceptable subject to NRC approval of WCAP-9226.

The review of this document has progressed sufficiently to indicate that its methodology is generally acceptable.

I 07/12/85 15-13 SOUTH TEXA5 SER SEC 15 s

15.2 Decrease in Heat Removal by the Secondary System The applicant's analyses of events that result in a decrease in heat removal by the secondary system are presented below.

15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow In Section 15.2.1 of the FSAR the applicant states that there are no steam pressure regulators whose failure or malfunction would cause a steamflow transient.

15.2.2 Loss of External Load In a loss of external load event, an electrical disturbance can cause a loss of a significant portion of the generator load.

Tiiis loss of load situation differs from the loss of ac power condition considered in Section 15.2.6 in that offsite power remains available to operate the station auxiliaries uch as the reactor coolant pumps.

The onsite diesel generators are therefore not required for this transient.

In the event that the steam dump valves fail to open following loss of load, the SG safety valves may lift and the reactor would be tripped on high pressurizer pressure or overtemperature AT.

In addition, the applicant states that the results of the turbine trip event analysis are more severe than those expected for the loss of external load.

The reason giver. is that a turbine trip actuates the turbine stop valves whereas a loss of external load actuates only the turbine control valves.

07/12/85 15-14 SOUTH TEXAS SER SEC 15

Since the stop valve can more suddenly cut off the steam flow to the turbine this is a more severe " decreased heat removal" transient.

15.2.3 Turbine Trip The applicant analyzed the turbine trip event for a complete loss of steam load from 102% power without a direct reactor trip (on turbine trip) and with only the pressurizer and steam generator safety valves assumed for pressure relief.

The applicant states that RCS temperatures and pressures do not increase signi-ficantly if the turbine bypass system and pressurizer pressure control systems function properly.

However, loss of the condenser would result in loss of main feedwater and could result in lifting the SG safety valves.

Reactor protection would be provided by the high pressurizer pressure, high pressurizer level, or overtemperature AT trips.

The applicant did not take -

credit for auxiliary feedwater actuation, the turbine bypass system or the SG power-operated relief valves.

The transient was analyzed with both minimum and maximum reactivity feedback. These two cases were analyzed with and without credit taken for pressurizer spray and pressurizer PORVs.

The FSAR results show that the RCS peak pressure for all of the cases was below 2550 psia, which is well below the SRP limit of 110% of design pressure.

For these assumptions, the minimum DNBR is 1.50 which is above the minimum limiting value of 1.30.

The acceptance criteria for A00s, including conformance with GDCs 10,15 eind 26 are met.

The consequences of a turbine trip without offsite power available are discussed in Section 15.2.6.

07/12/85 15-15 SOUTH TEXAS SER SEC 15

l 15.2.4 Inadvertent Closure of Main Steam Isolation Valves Inadvertent closure of the main steam isolation valves would result in a tur-bine trip without the turbine bypass system.

This event is identical to the turbine trip which is described in Section 15.2.3 of this SER.

15.2.5 Loss of Condenser Vacuum and Other Events Resulting in a Turbine Trip Loss of the condenser vacuum is an event that can cause a turbine trip.

In addition, loss of the condenser will preclude the use of the steam dump.

The turbine trip analysis does not take credit for the steam dump, hence, this event is identical to the turbine trip transient which is described in Section 15.2.3 of this SER.

15.2.6 Loss of Nonemergency AC Power to the Plant Auxiliaries The loss of the nonemergency ac power can be caused by a complete loss of the offsite grid followed by a turbine trip or a loss of the onsite ac distribution system.

A loss of nonemergency ac power event is more limiting than the turbine-trip-initiated decrease in secondary heat removal without loss of ac power because the RCPs are lost and the subsequent flow coastdown further reduces the rate of i

heat removed from the core.

In this transient, the loss of offsite power is closely followed by turbine trip and reactor trip.

The reactor trip is assumed to come from either the turbine trip, loss of power to the control rod drive mechanisms or from one of the trip setpoints in the primary or secondary 07/12/85 15-16 SOUTH TEXAS SER SEC 15

systems that would be reached as a result of the flow coastdown and decrease in secondary heat removal.

The applicant has not analyzed this event in detail in FSAR Section 15.2.6.

This event is analyzed in Section 15.2.7 under " loss of normal feedwater system caused by a loss of offsite power." Since the two events are identical, the stafi'sevaluationisincludedinSection15.2.7.

15.2.7 Loss of Normal Feedwater Flow A loss of normal feedwater flow can be caused by failures in the main feedwater system such as pump or valve malfunctions or by the loss of ac power.

If the event is initiated by a loss of ac power, then the consequences are identical to those of the loss of nonemergency ac power event that is discussed in Sec-tion 15.2.6.

The applicant has analyzed this event for this case.

The result isthattherewillbeareductioninthecapabihityofthesecondarysideto-remove heat from the primary. side.

In order to maximize the consequences of the event, the applicant's assumptions were made so as to minimize the heat removal capability and to maximize the initial energy in the core.

The assump-tions included a heat transfer coefficient associated with natural circulation of the RCS, the plant initially operating at 102% of design, auxiliary feedwater initiated by SG low-low level with two auxiliary feedwater pumps delivering to two steam generators.

The analysis shows that a low-low level in a SG will initiate reactor trip.

Since the condenser would be unavailable, the secondary side pressure rise will i

l 07/12/85 15-17 SOUTH TEXAS SER SEC 15

,,7 e

a w wv-

++

~.

\\

l be limited by lifting the secondary relief and safety valves.

However, the applicant only took credit for the safety valves.

The applicant's LOFTRAN analysis shows that the natural circulation flow avail-4 able adequately transfers the decay heat from the core to the steam generators.

DNBR never decreases below the initial value.

Assuming that the primary PORVs are not operable, the primary pressure rises to the pressurizer safety valve actuation point (2500 psia). The pressurizer level stays sufficiently low to preclude liquid relief.

Steam generator levels stay sufficiently high to assure that adequate heat transfer area is always available.

This event is the most limiting A00 in the " decrease in heat removal" category.

The acceptance criteria for A00s, including conformance with GDCs 10, 15 and 26 are met. The analysis also conforms with GDC17.

15.2.8 Feedwater system Pipe Break The applicant submitted feedwater system pipe break analyses both with and l

without offsite power availability.

The results of the analyses indicate that the pressurizer would fill with liquid and that liquid relief would occur through the primary PORVs and/or safety valves.

Staff expressed its concern i

that these valves were not specifically designed or qualified for liquid or two phase flow.

(See Section 5.2) The applicant committed to reanalyze this event and provide revised FSAR documentation and figures during the third quarter of f

CY1985.

7 i

We will provide our evaluation of the applicant's reanalysis in the final SER.

t 07/12/85 15-18 SOUTH TdXAS SER SEC 15 5

I

15.3 Decreases in Reactor Coolant Flow Rate 15.3.1/15.3.2 Loss of Forced Reactor Coolant Flow, Including Trip of Pump A partial loss of coolant flow may be caused by a mechanical or electrical failure in a RCP motor, or a fault in the power supply to a RCP.

A complete loss of flow may result from the simultaneo'ss loss of electrical power to all pump motors.

The loss of coolant flow, if the reactor is at power, will result in a rapid increase in coolant temperature.

Core protection against the partial and complete loss of coolant flow events is provided by reactor trip on low primary coolant flow. Above interlock P8, low flow in any one loop will initiate a reactor trip while a reactor trip will be actuated on low flow in any two loops if the power level is below P8 but above P7 (abeit 10% power).

Also above P7, the undervoltage reactor trip is available.

Frequency disturbances in the power grid can result in a reactor trip on RCP underfrequency.

In response to a staff inquiry regarding whether adequate core cooling can be maintained with natural circulation below 10%

power, the applicant responded that calculations indicate that at 10 percent power the RCS natural circulation flow would be approximately 6.5 percent of nominal flow.

Provisions have been made for a natural circulation test during plant startup at less than 10% power.

The partial loss of reactor coolant flow was analyzed for a loss of one pump with both three and four loops in operation.

The complete loss of coolant flow event was analyzed with loss of all four pumps with all four loops in operation 07/12/85 15-19 SOUTH TEXAS SER SEC 15

and with loss of 3 pumps with 3 loops in operation.

These events were reviewed with the procedures and acceptance criteria set forth in SRP 15.3.1-15.3.2.

Results provided by the applicant show that primary pressure remains well below the 110% of design pressure criteria.

For both cases, the results show a de-crease in the margin to DNB with the complete loss of coolant flow being more limiting.

However, even for the limiting. case, the minimum DNBR, which is reached about 3 seconds into the transient, remains above 1.30.

The acceptance criteria for A00s, including conformance with GDCs 10, 15 and 26 are met.

15.3.3/15.3.4 Reactor Coolant Pump Rotor Seizure and Shaft Break Accident The applicant has analyzed the reactor coolant pump (RCP) rotor seizure with the LOFTRAlf, FACTRAN and THINC computer codes.

Since the consequences of a shaft break event are no worse than for an RCP rotor seizure, only the locked rotor event was analyzed in detail.

The analysis assumes that offsite power is available and was done for both four and three loops in operation.

A rapid buildup in the coolant temperature results in expansion of the coolant into the pressurizer causing a pressure increase in the RCS.

In the analysis, the applicant states that credit was not taken for the pressurizer PORVs or for the pressurizer spray.

The pressurizer safety valves are taken credit for in order to maintain pressure below the 110% of design limitation.

The results show i

that 7% of the fuel rods go into DNB and are thus assumed tu tail.

The maximum pressure was calculated to be about 2650 psia.

1 I

In order to meet the requirements of GDC 17, the applicant will reanalyze this event assuming LOOP.

We also require that the applicant provide pressurizer 07/12/85 15-20 SOUTH TEXAS SER SEC 15

level information to determine whether liquid relief occurs via the PORVs or SVs. We will provide our evaluation in a supplement to this SER.

15.4 Reactivity and Power Distribution Anomalies In the following sections, the staff addresses the applicant's evaluation of events that result in reactivity and power distribution anomalies.

15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature The applicant assumed that the transient began at a power level of abort 75%.

During the first part of the transient, the increase in core flow with cold water results in an increase in nuclear power and a decrease in core average temperature.

Reactivity addition for the inactive loop startup event is the result of the decrease in core inlet water temperature.

This transient was

~

evaluated by the applicant using a mathematical model that has been reviewed and found acceptable to the staff. The maximum calculated RCS pressure is below 2400 psia and the minimum DNBR is above 1.3 throughout the transient.

15.4.6 Inadvertent Boron Dilution Unborated water can be added to the reactor coolant system, via the chemical and volume control system (CVCS), to increase core reactivity.

This may happen inadvertently, because of operator error or CVCS malfunction, and cause an unwanted increase in reactivity and decrease in shutdown margin.

The applicant has provided analyses for the refueling, startup, full power and hot standby modes, but not for the hot and cold shutdown modes.

The results of the l

I 07/12/85 15-21 SOUTH TEXAS SER SEC 15

analyses for the latter modes may bound the results of analyses for modes 1, 2, 3, and 6.

The applicant has not provided information on the redundancy of alarms and indications that would alert the operators to the occurrence of a boron dilution event (BDE), nor on the times available for operator action after receipt of an alarm.

The staff requested that the applicant provide additional information on this event, including:

a list of alarms and indications that would alert the opera-tors to the occurrence of a BDE, including verification of their redundancy, and a description of any automatic mitigation systems; BDE analyses for modes 4, 5 and 6 that demonstrate that the minimum time available for operator action following receipt of an alarm before shutdown margin is lost will conform with the SRP Section 15.4.6 criteria, assuming maximum charging and reactor makeup flow capability; demonstration that all possible dilution flow paths have locked closed valves during mode 6; confirmation that technical specifications require operability of BDE alarms during all operational codes, and surveillance of locked closed valves.

The staff also requested a description of the analytical model used in the BDE calculations.

The applicant responded that the requested information would be provided in September 1985.

The staff evaluation will be provided in the final SER.

15.5 Increases in RCS Inventory 15.5.1/15.5.2 Inadvertent Operation of ECCS During Power Operation /CVCS Malfunction That Increases Reactor Coolant Inventory i

07/12/85 15-22 SOUTH TEXAS SER SEC 15 l

A spurious SI signal at power would have no effect on the RCS since the shutoff head of the HHSI pumps is less than 1700 psi.

The HHSI pumps are protected against deadheading by miniflow lines.

The most serious CVCS malfunction would be failure of the pressurizer level channel being used for charging control in the low direction.

This would cause maximum charging flow to the RCS and isolation of letdown flow.

This case also assumes that the charging pumps draw unborated water from the volume control tank.

Four cases were analyzed using LOFTRAN, i.e., maximum and minimum reactivity, each with and without automatic spray.

The most severe case would be maximum reactivity with pressurizer spray, for which the pressurizer would be filled in 767 seconds.

Nuclear power, T,y, and DNBR remain relatively unchanged.

The applicant states that the operator would have sufficient time to stop the charging pumps before pressurizer fill.

The staff concurs with this conclusion since the recommendations of draft ANSI N660 for a condition II event are met.

15.6 Decrease in Reactor Coolant Inventory l

15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve l

The applicant provided the results of an analysis for inadvertent opening of a l

pressurizer safety valve.

This event bounds the inadvertent opening of a j

relief valve.

During this event, nuclear power is maintained at the initial value until reactor trip occurs on low pressurizer pressure.

The DNBR decreases initially, but increases rapidly following the trip.

The minimum DNBR of approximately 1.5 occurred at about 22 seconds into the transient.

The RCS pressure decreases throughout the transient.

07/12/85 15-23 SOUTH TEXAS SER SEC 15

In response to TMI Action Items II.K.3.1 (Installation and Testing of Automatic Power Operated Relief Valve (PORV) Isolation System) and II.K.3.2 (Repoit on Overall Safety Effect of Power-0perat'ed Relief Valve Isolation System) the applicant stated that, in support of the Westinghouse Owners Group, Westing-house submitted generic report WCAP9804, which concluded that with the incorporation of specific post-TMI modifications, which have been or will,be implemented on STP, the reduction in PORV 1.0CA frequency is such that an auto-matic PORV block valve closure system is not required.

15.6.3 Steam Generator Tube Rupture (SGTR)

The applicant has provided an analysis of the systems response and radiological consequences of the complete severance of a single steam generator tube.

This analysis is based on the ability to isolate the affected SG within 30 minutes.

The analysis was performed both with and without off-site power available.

The staff has questioned the capability to terminate the leak in 30 minutes based on previous SGTR incidents, and has requested that the applicant provide the sequence of events and justification of operator action times assumed.

The staff also requested coafirmation that systems and components assumed to miti-gate the consequences of the accident are safety grade, and the consequences of overfill with regard to integrity of the steamlines and secondary safety and relief valves.

The applicant responded that the Westinghouse Owners Group is investigating SGTR licensing concerns and has submitted WCAP-10698 to NRC.

A supplement to this WCAP regarding the effects of overfill is scheduled for November 1985.

The staff will review the submittals and prepare a generic SER on the subject.

l 07/12/85 15-24 SOUTH TEXAS SER SEC 15

However, the applicant is still required to submit plant specific information, 1

including a steam line static load analysis, and justification that systems and components assumed to mitigate the accident are safety grade.

As noted in section 5.2, if credit is taken for PORV operation in the SGTR analysis, the PORV actuation circuitry would have to be upgraded to safety grade standards.

The staff will provide an evaluation of this event in a SER supplement.

In Section 15.1.5, it was noted that the STP design provides for MSIV closure on any SI actuation signal, including low pressurizer, Hi-1 containment pres-sure, and " excessive cooldown protection" signal.

The more typical design for Westinghouse plants involves MSIV closure on Hi-2 containment pressure or other evidence of steam line break.

The staff expressed its concern that closure of the intact SG MSIVs on any SI signal would prevent utilization of condenser steam dump in the event of SGTR or small break LOCA when offsite power is available.

The Westinghouse emergency response" guidelines (ERGS), which have been approved by NRC, take credit for condenser steam dump when it is available for the above PA's, since its utilization would tend to result in more rapid mitigation of the accident and lower offsite doses than atmospheric steam dump.

The applicant's response indicated that the STP emergency operating procedures (EOPs) would instruct the operators to reopen the MSIVs or open the MSIV bypass valves for the intact SGs if the condenser is available.

The applicant con-l cluded that automatic MSIV closure would not adversely affect accident recovery.

The staff is also concerned about inadequate MSIV closure due to spurious SI actuation signals, which have occurred on a number of operating plants.

07/12/85 15-25 SOUTH TEXAS SER SEC 15

'o

~

Inadvertent MSIV closure could result in a rapid increase in SG secondary pressure, with consequent unnecessary challenges to the secondary SVs and PORVs, and possible decrease in long term reliability of these valves, and could also affect the long term reliability of the MSIVs, as well as increasing offsite radiation dose.

Therefore, the applicant should confirm that the STP design for MSIV closure affords the same level of safety as the more typical Westinghouse design.

15.6.5 LOCA The applicant has analyzed the double-ended cold leg guillotine (DECLG) as the most limiting large-break LOCA.

The analysis was performed using three differ-ent flow coefficients.

The results of these calculations show that the DECLG with a Moody break discharge coefficient of 0.6 with maximum safety injection is the limiting case.

In this analysis, peak clad temperature (PCT) reached 1981'F (see Section 6.5).

TheaccidentisterminatedbyECCSoperation.

Only safety grade equipment is used to mitigate the accident.

The small break LOCA analysis was performed for a period of about 1500 seconds for 3 in., 4 in., and 6 in, diameter breaks.

The results show that the 4 in.

break results in the highest PCT (1201*F).

In Section 6.3 we stated our con-cern regarding long term decay heat removal for certain size small break LOCAs and the additional applicant analyses deemed necessary to satisfy our concerns.

l The applicant has performed analyses of the performance of the ECCS in accord-ance with the Commission's regulationn (10 CFR 50.46 and Appendix K to 10 CFR

50) except as noted in SER Section 6.3.

The analyses considered a spectrum of 07/12/85 15-26 SOUTH TEXAS SER SEC 15

- -. ~

e S

j postulated break sizes and locations.

The results show that the ECCS satisfies the following criteria:

i (1) The calculated maximum fuel rod cladding temperature does not exceed 220'0*F.

(2) The calculated maximum local oxidation of the cladding does not exceed 17%

of the total cladding thickness before oxidation.

(3) The calculated total amount of hydrogen generated from the chemical reac-tion of the cladding with water or steam does not exceed 1% of the hypo-thetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding I

t surrounding the plenum volume, were to react.

l (4) Calculated changes in core geometry are such that the core remains amen-able to cooling.

(5) After any calculated successful initial operation of the ECCS, the calcu-lated core temperature is maintained at an acceptable low value and decay heat is removed for the extended period of time required by the long-lived radioactivity.

~

In response to TMI Action Item II.K.3.30 (Revised Small-Break LOCA Methods to Show Compliance with 10 CFR Part 50, Appendix K) the applicant stated that the Westinghouse Owners Group has submitted a new small-break evaluation model in WCAP 10054, dated March 1982.

The staff has completed its review and concluded that the Westinghouse response is acceptable.

It is the staff's understanding 07/12/85 15-27 SOUTH TEXAS SER SEC 15

,-.r.m

..----e-,--

-- ~. -w~----

e------,--

---en-----,-w--,----c-*

w

--=---~ve--

- ~ = - - * -

' '- *- =

en

- -o that Westinghouse intends to submit generic analyses in response to Action Item II.K.3.31, utilizing the h0 TRUMP program.

The staff finds this acceptable.

Compliance with Task Action Plan Item II.K.3.5 (Automated Trip of RCPs during LOCAs) is adaressed in the Westinghouse Owners Group letters OG-110, December 1983, and OG-117, March 1984, in response to generic letter 83-10C which delin-eates the staff resolution of II.K.3.5.

These responses are under staff review.

The staff concludes that the calculated performance of the ECCS following postulated LOCA accidents conform to the Commission's regulations and to applicable regulatory guides and staff technical positions (except as noted),

and the ECCS performance is considered acceptable, with the exception of the open and confirmatory items listed at the end of SER Section 6.3.

t l

l l

l t

i l

b l

07/12/85 15-28 SOUTH TEXAS SER SEC 15

_